Google Cloud has fully mitigated a security vulnerability in its Dialogflow CX platform, which cybersecurity firm Varonis named 'Rogue Agent'. The complete fix was deployed in June 2026, following an initial patch rolled out in April 2026.

Varonis reported the vulnerability to Google Cloud in November 2025. A Google Cloud spokesperson stated in June 2026 that the underlying issue has been fully mitigated and that the company has no known indication of customer compromise as a result of the flaw.

Dialogflow CX is an enterprise-grade conversational AI platform that enables organizations to build virtual agents and chatbots. It utilizes Playbooks that offer Code Blocks to embed custom Python logic into conversation flows. These Code Blocks allow agents to process user input, call APIs, and manipulate data, executing within the Cloud Run service.

Varonis discovered that it was possible to modify a key file responsible for executing Code Blocks using Python's exec() function. This allowed for the key file to be overwritten to implement malicious code. The modification of this key file did not appear in logs, potentially circumventing detection.

The vulnerability could allow attackers to exfiltrate user conversations and inject phishing prompts that appeared as legitimate reauthentication requests. Attackers could also establish a bidirectional communication channel to an external server, bypassing VPC Service Controls. "Here lies the critical design detail — all Dialogflow agents that use Code Blocks in the same GCP project effectively share the same Cloud Run execution environment, which is managed by Google and is outside the victim's scope," Varonis said.

Exploitation of the vulnerability required updating the dialogflow.playbooks.update permission on one Dialogflow agent. "Because the injected Code Block is executed in the same scope inside exec(), attackers could reference these variables directly. This meant full visibility into ongoing conversations and the ability to hijack sessions or impersonate legitimate flows," Varonis said.

"The result? Attackers could silently take control of every agent in the same GCP project, manipulate conversations, and exfiltrate sensitive data without detection. For organizations relying on Dialogflow CX for customer interactions, this flaw represented a catastrophic breach of trust, all from a single, overlooked permission on a single agent," Varonis reported. The firm advised organizations to review their logs for Playbook updates.

Tamir Yehuda, cloud security research team leader at Varonis, said: "AI services are intertwined with cloud services, and the risks are often overlooked. Security and IT teams must evaluate the architecture of cloud providers' AI services. Sometimes you will find vulnerabilities." He added: "Often, there are misconfiguration opportunities that can be just as risky, such as alternative access to your AI chatbot or data via another cloud service. The cloud is like a game of Jenga, everything is connected, and if you pull the right brick, everything falls apart."