Rogue Agent Flaw in Google Dialogflow CX Enabled Cross-Agent Code Injection

Varonis Threat Labs disclosed a critical vulnerability chain in Google Cloud Dialogflow CX dubbed Rogue Agent that allowed attackers with only the dialogflow.playbooks.update permission on one agent to inject persistent malicious Python code into shared Playbook Code Blocks. The flaw arose because Dialogflow CX executed code in a common Google-managed Cloud Run environment, where a writable code_execution_env.py file and use of Python exec() allowed arbitrary code execution that could affect other agents in the same GCP project.

Successful exploitation could let an attacker exfiltrate conversation history, manipulate chatbot responses, impersonate agents for phishing, bypass VPC Service Controls through unrestricted outbound internet access, and obtain low-privilege Google-managed service account tokens via the Instance Metadata Service. Varonis reported the issue to Google in November 2025; Google released an initial fix in April 2026 and fully remediated the affected components in June 2026. Researchers said they were not aware of exploitation in the wild before the patches and advised customers to review Dialogflow CX Playbook changes and related logs for suspicious activity.