Varonis Threat Labs discovered a critical vulnerability in Google Cloud Platform’s Dialogflow CX service, Google’s conversational AI platform for building voice and text chatbots. The team named the discovery “Rogue Agent,” and the flaw allowed attackers to inject persistent malicious code into the Dialogflow agent pipeline through the Code Blocks feature, silently exfiltrating conversations and conducting phishing campaigns at scale.<\/p>\n
Dialogflow CX uses Playbooks to structure conversation workflows. Within those Playbooks, Code Blocks let developers embed custom Python logic directly into conversation flows so an agent can process user input, call external APIs, and manipulate data inside a Google-managed Cloud Run service.<\/p>\n
All Dialogflow agents that use Code Blocks within the same GCP project effectively share the same Cloud Run execution environment, a service that sits outside the customer’s direct visibility and runs with public outbound network access by default. That shared, externally managed environment is central to how the attack worked.<\/p>\n
Starting the exploit required only a single permission: Researchers found a writable Python file called The exploit chain was straightforward:<\/p>\n Cloud Logging did not record the file overwrite or the injected logic, making detection extremely difficult. From a single foothold on one agent, an attacker could effectively compromise other agents in the same project by leveraging the shared execution environment.<\/p>\n Alongside the code injection flaw, the researchers identified two related issues that widened the impact.<\/p>\n Code Blocks ran inside a Google-managed Cloud Run service with unrestricted outbound internet access, effectively placing that environment outside the project’s VPC-SC perimeter. Using preinstalled libraries such as urllib, the team established a bidirectional channel from the execution environment to an external server and bypassed VPC-SC entirely, enabling data exfiltration and a potential command-and-control channel even on agents protected by perimeter controls.<\/p>\n The Instance Metadata Service was reachable from within the Cloud Run environment. Querying IMDS returned access tokens belonging to a Google-managed service account. While the tokens belonged to a low-privileged account, the team noted that code execution environments should never have access to IMDS, since that violates isolation principles and creates systemic risk if the service account were ever granted additional rights.<\/p>\n Varonis first reported the vulnerability to Google in November 2025. Google issued an initial security update in April 2026 and fully resolved the issue in June 2026. All affected components have since been remediated. Varonis and Google are not aware of any exploitation in the wild before the patch release. Before the patch, any GCP organization using Dialogflow CX agents with Playbook Code Blocks was potentially at risk.<\/p>\n Because the overwrite occurred in a Google-managed Cloud Run environment outside the customer’s direct visibility, detection had to rely on adjacent signals. Varonis recommended several steps for organizations to confirm they were not affected.<\/p>\n Google and Varonis also advised auditing Dialogflow CX configurations for suspicious Playbook updates and analyzing past playbook update actions.<\/p>\n Dialogflow agents support customer support systems, financial services bots, healthcare assistants, and enterprise workflows that handle personally identifiable information, payment details, and confidential business data. A flaw that let attackers silently hijack sessions, inject phishing prompts, and exfiltrate conversations represented a serious breach of trust for any organization relying on the platform.<\/p>\n Rogue Agent is the latest in a series of AI-related threats Varonis has responsibly disclosed through work with cloud providers, including Reprompt in Microsoft Copilot Personal and SearchLeak in Microsoft Copilot Enterprise. The research underlines that cloud services such as Dialogflow are deeply integrated with other GCP components, that security features are not always properly implemented, and that defenders need visibility and controls across every layer rather than relying on the perimeter alone.<\/p>\n Rogue Agent is the name Varonis Threat Labs gave to a critical code injection vulnerability in Google Cloud Platform’s Dialogflow CX service that let attackers inject persistent malicious code through the Code Blocks feature, silently exfiltrating conversations and running phishing campaigns at scale.<\/p>\n An attacker needed only the Google issued an initial security update in April 2026 after Varonis reported the issue in November 2025, and fully resolved the issue in June 2026. Varonis and Google are not aware of any exploitation in the wild before the patch.<\/p>\ndialogflow.playbooks.update<\/code> on one agent. The shared Cloud Run service that ran Code Block code had public network access, a write-enabled filesystem, and ran under a user with privileges to modify system files.<\/p>\ncode_execution_env.py<\/code> that the platform used to execute configured Playbook Code Blocks via Python’s exec()<\/code> function. Because the configured Code Block was simply appended to internal system code before being passed to exec()<\/code>, and because injected Code Blocks ran in the same scope, attackers could reference variables that exposed the full conversation history and session-level parameters. They could also call internal functions such as respond()<\/code> to force the agent to return attacker-supplied strings, making those strings appear to come from the underlying model.<\/p>\n\n
code_execution_env.py<\/code> from an attacker-controlled public storage bucket and overwrote the original file inside the Cloud Run container.<\/li>\nexec()<\/code>, exfiltrated conversation data to an attacker-controlled server, and used respond()<\/code> to inject phishing prompts disguised as legitimate reauthentication requests.<\/li>\nWhat additional weaknesses were found?<\/h2>\n
VPC Service Controls bypass<\/h3>\n
Credential exposure via IMDS<\/h3>\n
When was it disclosed and fixed?<\/h2>\n
How could organizations detect and respond?<\/h2>\n
\n
protoPayload.status.message<\/code> for failed user requests, since messages in that field can surface exceptions thrown by malicious Code Blocks.<\/li>\nWhy does this matter?<\/h2>\n
FAQ<\/h2>\n
What is Rogue Agent?<\/h3>\n
What permission did an attacker need to exploit the flaw?<\/h3>\n
dialogflow.playbooks.update<\/code> permission on a single Dialogflow agent within a GCP project to begin the exploit, because Code Blocks ran in a shared Cloud Run environment that could compromise other agents in the same project.<\/p>\nWhen did Google fix the vulnerability?<\/h3>\n