Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots
Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots
https://thehackernews.com/2026/07/rogue-agent-flaw-could-have-let.html
Publish Date: 2026-07-07 12:37:00
Source Domain: thehackernews.com
A critical flaw in Google’s Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project.
From there, they could read live conversations, steal the data users shared, and make the bots send attacker-written messages, including requests to re-enter a password.
Security firm Varonis found it and named it Rogue Agent. The flaw affected only organizations that built agents with Dialogflow’s Playbooks and custom Code Blocks, which let developers add their own Python. And it was not a remote, unauthenticated attack.
Pulling it off needed the dialogflow.playbooks.update permission on one such agent, which limits the realistic attacker to a malicious insider or a compromised developer account, not a stranger on the internet. From that one foothold, though, the reach extended to every agent in the project.
Google has fixed it, and both Varonis and Google say there is no sign the flaw was ever used in a real attack.
One writable file ran every agent’s Code Blocks
Dialogflow’s Code Blocks let developers add custom Python to a chatbot’s conversation flow to check input, control behavior, and invoke defined tools. That code runs in a Google-managed Cloud Run environment, and every agent that uses Code Blocks in the same Google Cloud project shares one instance of it.
Google runs that environment, the customer cannot see or control it, and Varonis found no real isolation between the agents inside it.
When an agent runs a Code Block, the developer’s code is appended to internal setup code and passed to Python’s exec() function. That setup code defines the variables and functions the block can touch. Variables include history for the full conversation and state for session details like the session ID. Functions include respond(), which makes the bot reply with a given string.
Varonis found the file that does this wrapping, code_execution_env.py, sitting in the…
