Varonis Threat Labs disclosed a critical vulnerability in Google Cloud’s Dialogflow CX service called Rogue Agent, which let attackers inject persistent malicious code into a Dialogflow agent pipeline by abusing the platform’s Code Blocks feature. Once planted, the code could silently exfiltrate conversations and run large-scale phishing campaigns while remaining nearly invisible to defenders. Google issued an initial fix in April 2026 and fully resolved the issue in June 2026.
How the Rogue Agent exploit worked
Dialogflow CX uses Playbooks to structure conversations, and Code Blocks let developers embed custom Python logic directly into those flows. Those Code Blocks execute inside a Google-managed Cloud Run service with public network egress enabled by default. All Dialogflow agents that use Code Blocks within the same GCP project share the same Cloud Run execution environment, a Google-managed space that sits outside the customer’s direct visibility.
The only permission required to configure Code Blocks is dialogflow.playbooks.update, which can be scoped to a single agent. Because Playbooks can include Code Blocks, they also enabled arbitrary Python execution by design. The researchers found no restrictions on what that code could do.
Enumeration of the Cloud Run filesystem revealed a writable file called code_execution_env.py, which was responsible for running configured Playbook Code Blocks through Python’s exec() function. Overwriting that file let an attacker run their own code with access to session parameters and conversation history.
The attack chain step by step
- The attacker created a modified
code_execution_env.pythat intercepted every execution before callingexec(). - The modified file exfiltrated conversation data to an attacker-controlled server using access to internal parameters.
- It injected phishing prompts disguised as legitimate reauthentication requests by calling the internal
respond()function, tricking users into submitting credentials.
A Code Block configured to download a modified code_execution_env.py from an attacker-controlled public GCS bucket handled the overwrite. After the overwrite, the attacker could restore the original Code Block configuration in the Dialogflow console UI to make activity appear normal. The malicious code persisted in the Cloud Run environment, and Cloud Logging did not record the overwrite or the injected logic.
Two additional weaknesses that amplified the risk
Could Rogue Agent bypass VPC Service Controls?
Dialogflow CX agents often operate behind VPC Service Controls, which enforce perimeter security to prevent data exfiltration. Because Code Blocks run inside a Google-managed Cloud Run service with unrestricted outbound internet access, the execution environment effectively sits outside the project’s VPC-SC perimeter. Using preinstalled libraries such as urllib, the researchers established a bidirectional channel from the execution environment to an external server, bypassing VPC-SC entirely and enabling both data exfiltration and command-and-control.
Credential leakage via IMDS
The Instance Metadata Service (IMDS) was exposed within the Cloud Run service environment. Querying IMDS returned access tokens belonging to a Google-managed service account. The account itself held low privileges, but the architectural flaw is significant: code execution environments should never have access to IMDS.
How to detect and remediate Rogue Agent
Detection was difficult because the overwrite happened in a Google-managed Cloud Run environment outside the victim’s scope, and Cloud Logging does not capture the exact configuration changes. Varonis and Google recommend that organizations audit their Dialogflow CX configurations for suspicious Playbook updates and analyze past playbook update actions.
Review logs for playbook updates
If DATA_WRITE Audit Logs are enabled for the Dialogflow API, look for successful past events and correlate them with indicators such as rare API access by a user, unusual IP addresses, or atypical access times. A Cloud Logging query for failed requests can surface exceptions thrown by Code Blocks that may have been triggered by malicious logic.
Manually review Code Blocks
In the Dialogflow CX console for each agent, navigate to Playbooks and review each Playbook’s current Code Block configuration. Confirm that all configured Code Blocks are whitelisted and approved. Attackers with sufficient sophistication can remove malicious blocks after exploitation, so detection should not rely on that step alone.
When was Rogue Agent disclosed and patched?
Varonis initially reported the vulnerability in November 2025. Google issued an initial security update in April 2026 and fully resolved the issue in June 2026. All affected components have since been remediated, and Varonis is not aware of any exploitation in the wild before the patch release. Before the patch, any GCP organization using Dialogflow CX agents with Playbook Code Blocks was potentially at risk.
The broader takeaway for AI agent security
Rogue Agent is one entry in a growing catalog of AI agent vulnerabilities disclosed by Varonis, alongside findings such as Reprompt in Microsoft Copilot Personal and SearchLeak in Microsoft Copilot Enterprise. As AI agents take on roles in customer support, financial services, healthcare, and enterprise workflows that handle personally identifiable information, payment details, and confidential business data, the security posture of the underlying cloud environments becomes critical. When event data and logging are not enough, organizations need behavioral analytics and posture management solutions to keep AI configurations aligned with best practices, and defenders need a deep understanding of how cloud services connect across their architecture.
FAQ
What is the Rogue Agent vulnerability in Google Dialogflow CX?
Rogue Agent is a critical flaw discovered by Varonis Threat Labs in Google Cloud’s Dialogflow CX service. It let attackers inject persistent malicious Python code into a Dialogflow agent pipeline by abusing the Code Blocks feature, enabling silent exfiltration of conversations and large-scale phishing.
Was Rogue Agent exploited before Google patched it?
Varonis is not aware of any exploitation in the wild before the patch release. Google issued an initial security update in April 2026 and fully resolved the issue in June 2026, and all affected components have since been remediated.
How can organizations detect a Rogue Agent compromise?
Organizations should review past successful Dialogflow API DATA_WRITE Audit Logs for rare users, unusual IP addresses, and atypical access times, run Cloud Logging queries for failed requests thrown by Code Blocks, and manually inspect every Playbook’s Code Block configuration in the Dialogflow CX console against an approved whitelist.
Want help with this in Myrtle Beach or Long Island? Talk to us.
NewSunSEO
Grow in Google and AI Search
AI-SEO, local search, paid ads and websites from one team, with offices on Long Island and in Myrtle Beach.
- AI-SEO
- Local AI-SEO
- AI Consulting
- PPC
- Web Design
- Web Development
- Long Island Office(631) 320-1700
- Myrtle Beach Office(843) 492-7131
Request a Free Proposal
Tell us about your business and where you want to grow.
We will reply by email to talk through your goals and what a proposal would include.
We use your details only to reply to you and send what you asked for. See our Privacy Policy.
