A Rogue Google Dialogflow Agent Could Hijack Enterprise Chatbots

Varonis Threat Labs just dropped a report on a vulnerability they're calling Rogue Agent, and it's a solid case study in why bolting AI features onto cloud infrastructure creates problems nobody fully thought through. The target was Dialogflow CX, Google's platform for building the chatbots that power customer service lines, banking apps, and healthcare portals. The culprit was a feature called Code Blocks, which lets developers embed Python directly into a conversation flow so the bot can call APIs or crunch data mid-chat.

Here's the design flaw: every agent using Code Blocks in the same GCP project shares one Cloud Run execution environment, managed entirely by Google. Customers can't see inside it or control it. Varonis found that environment had a writable filesystem, unrestricted internet access, and a key Python file — code_execution_env.py — that could simply be overwritten. Get one permission, dialogflow.playbooks.update, scoped to a single agent, and you could rewrite that file to hijack every other agent sharing the same backend. The researchers compared it to a turncoat spy exposing the whole network from one compromised post.

Once inside, an attacker could read full conversation histories, grab session IDs, and even force the bot's respond() function to output attacker-chosen text — meaning a fake reauthentication prompt could look exactly like a legitimate message from the AI. Varonis built a working proof-of-concept that stole submitted credentials this way, then quietly restored the original configuration afterward so the Dialogflow console showed nothing unusual. Cloud Logging never recorded the swap either. That combination made the attack close to undetectable from the customer side.

Two companion bugs made things worse. The same Cloud Run service could talk to the open internet even when a company had VPC Service Controls locked down, so attackers had a built-in bypass for network perimeters meant to satisfy GDPR or HIPAA compliance. And the environment exposed Google's Instance Metadata Service, letting researchers pull access tokens for a Google-managed service account — low-privilege, but a violation of basic isolation that shouldn't exist in any properly sandboxed execution environment.

Varonis reported the flaw in November 2025; Google shipped a partial fix in April 2026 and closed it fully by June. No known real-world exploitation before the patch, according to Varonis. Given that the firm says 80 percent of Fortune 500 companies run AI agents in production, and this follows similar disclosures in Microsoft Copilot, the pattern here isn't really about Google specifically — it's about how fast AI features are shipping ahead of the security models meant to contain them.