THE security research firm Varonis disclosed a flaw in Google Cloud’s Dialogflow CX service that let attackers seize control of AI-driven conversational agents and manipulate their dialogues (Varonis research).
The vulnerability, nicknamed “Rogue Agent”, could be abused to inject malicious code, steal data from chats and launch phishing campaigns (SecurityWeek reported).
The issue stemmed from the way Dialogflow CX handles “Code Blocks”, which allow users to run custom Python snippets inside a shared Cloud Run environment (DarkReading explained).
A permission-boundary gap meant that malicious code injected into a Code Block could escape its sandbox and gain arbitrary execution within the service’s pipeline.
Once inside the pipeline, an attacker could alter the flow of a conversation, exfiltrate user inputs or inject malicious responses that appeared to come from the legitimate bot (The Hacker News noted).
No CVE identifier was assigned to the flaw, but Varonis reported it to Google in November 2025.
Google issued a fix for the vulnerability in June 2026 after validating the report, and has stated that there are no known instances of the bug being exploited in the wild.
The advisory from Varonis notes that the attack required only the ability to create or modify a Code Block within a Dialogflow CX agent, a capability often granted to developers or integrators.
The case highlights how shared execution environments in cloud-based AI platforms can become a pivot point for privilege escalation if sandbox controls are not strictly enforced.
It also serves as a reminder that AI chatbot deployments must be subjected to the same rigorous configuration review as any other cloud workload.
Organisations using Dialogflow CX should audit who has permission to edit Code Blocks and enforce the principle of least privilege for those roles.
Monitoring logs for unexpected Python execution or outbound network calls from the Cloud Run instances can help detect attempted abuse.
Applying the June 2026 patch and restricting external internet access from the execution environment further reduces the attack surface.
Finally, red-team exercises that simulate Code Block abuse are recommended to verify that sandbox boundaries hold under realistic adversarial conditions.
Regularly revisiting identity and access management policies for AI services helps close gaps before they can be exploited.