Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots
Summary: Varonis found a flaw it named Rogue Agent in Google's Dialogflow CX that let anyone with edit rights on one Code Block-enabled agent overwrite the shared code_execution_env.py file and run attacker code across every Code Block-enabled agent in the same Google Cloud project. Google fixed it in April 2026 and fully resolved it in June 2026, about seven months after Varonis reported it through the Vulnerability Reward Program in November 2025, and both parties say there is no sign it was used in a real attack.
What you should know: The entire entry point was the dialogflow.playbooks.update permission, so an edit right on a chatbot was effectively a code-execution right over every agent in the project. The overwrite ran inside Google's environment, where Cloud Logging recorded neither the file change nor the injected code, leaving customers no way to inspect that runtime themselves.
Read the original at The Hacker News ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026