A Rogue Google Dialogflow Agent Could Hijack Enterprise Chatbots
The Neuron
Researchers at Varonis discovered a critical vulnerability in Google's Dialogflow CX service that allowed attackers with a single edit permission to inject malicious code into chatbot agents and steal conversation data. The vulnerability required only the dialogflow.playbooks.update permission on one agent to compromise all agents in the same Google Cloud project through shared Cloud Run infrastructure. Google patched the issue between April and June 2026, and organizations using Dialogflow CX are now advised to audit their configurations and review logs for suspicious playbook updates.
Why it matters
Varonis Threat Labs disclosed a vulnerability named Rogue Agent in Google Cloud's Dialogflow CX where an attacker with one edit permission on an agent could inject malicious code into the agent pipeline to access conversation history and steal credentials. Google issued an initial fix in April and fully resolved the issue in June, with no known real-world exploitation before the patch.
