# Google's "Rogue Agent" Vulnerability Exposed Millions of AI Conversations to Silent Hijacking


A critical flaw in Google Cloud's Dialogflow CX platform could have allowed attackers to silently control conversational AI agents, manipulate customer interactions, and exfiltrate sensitive data across entire enterprise deployments. The vulnerability—discovered by Varonis and disclosed in June 2026—represents a systemic design flaw that affects how Google isolates AI workloads in shared cloud environments.


## The Threat: A Backdoor into Enterprise AI


The vulnerability, dubbed "Rogue Agent," enabled attackers with minimal permissions to compromise every Dialogflow CX agent within the same Google Cloud project. Once an attacker gained write access to a critical execution file, they could:


  • Hijack ongoing conversations in real-time, impersonating legitimate agent workflows
  • Exfiltrate sensitive user data including personal information, financial details, and healthcare records
  • Inject phishing prompts disguised as legitimate system requests, enabling social engineering attacks
  • Bypass security controls including VPC Service Controls designed to enforce data perimeters
  • Access privileged credentials via the Instance Metadata Service (IMDS) to escalate attacks
  • Hide all traces of their activity—the attacks left no audit logs, making detection virtually impossible

    • For organizations running chatbots in customer service, financial services, healthcare, and other sensitive industries, this represented a catastrophic breach of trust stemming from a single overlooked permission setting.


    ## Background and Context: Why Dialogflow CX Matters


    Dialogflow CX is Google Cloud's enterprise-grade conversational AI platform, designed for organizations building complex virtual agents and chatbots. Unlike simpler rule-based systems, Dialogflow CX powers:


  • Customer support bots handling account inquiries, troubleshooting, and escalations
  • Financial services chatbots processing transactions and sensitive account information
  • Healthcare virtual assistants triaging patient questions and managing appointment scheduling
  • Sensitive data workflows where conversations contain PII, financial information, or protected health information

    • The platform's power comes from Playbooks—orchestration workflows that define conversation flows—and Code Blocks, which embed custom Python logic directly into these flows. This flexibility allows developers to integrate AI agents with internal APIs, databases, and business logic.


    ## Technical Details: How the Vulnerability Worked


    ### The Shared Execution Environment


    The critical design flaw lies in how Google implements Code Block execution:


    > All Dialogflow CX agents in the same Google Cloud project share the same Cloud Run execution environment, managed by Google outside the customer's control.


    This means an attacker targeting one agent could potentially compromise all agents in a project—a severe violation of the principle of least privilege. Here's how the attack unfolded:


    Step 1: Reconnaissance

    An attacker identifies a Dialogflow CX agent where the "configure Code Blocks" permission is enabled—a common setting for development and testing environments that often remains enabled in production.


    Step 2: File System Modification

    Within the Cloud Run instance, the attacker exploits:

  • Write-enabled file system access
  • Running under a user account with system file modification privileges
  • A key file responsible for executing Code Blocks using Python's exec() function

    • Step 3: Code Injection

    The attacker overwrites the key file with malicious Python code. Because the injected code runs within the same exec() scope as legitimate Code Blocks, the attacker gains:


  • Full visibility into conversation variables including user inputs, session state, and accessed data
  • Direct function access to internal Dialogflow functions that control agent behavior
  • Persistent execution on every subsequent Code Block invocation

    • Step 4: Lateral Movement and Exfiltration

    With code execution, the attacker can:

  • Establish bidirectional communication channels to external servers
  • Bypass VPC Service Controls (Google's data perimeter enforcement mechanism)
  • Query the Instance Metadata Service to retrieve access tokens for Google-managed service accounts
  • Chain attacks to compromise other systems accessible from the Cloud Run environment

    • ### Why Detection Remained Impossible


    The attack left no audit trails:

  • File modifications occurred outside Google Cloud's logging scope
  • Code Block executions appeared legitimate to Cloud Audit Logs
  • No network-level signatures signaled data exfiltration
  • The compromised environment remained under Google's management, outside customer security tooling

    • ---


    ## Implications: Who Was Exposed


    Vulnerable organizations included:


    | Industry | Risk | Typical Data at Risk |

    |----------|------|---------------------|

    | Financial Services | Account manipulation, fraud | Account balances, transaction history, authentication data |

    | Healthcare | Patient privacy violations | PHI, appointment records, medication information |

    | E-Commerce | Payment fraud | Credit card data, shipping addresses, order history |

    | Telecommunications | Service manipulation | Account access, billing data, subscriber information |

    | Government/Enterprise | Credential theft | Service account tokens, internal API access, citizen data |


    The vulnerability affected organizations that:

  • Deployed Dialogflow CX agents with Code Blocks enabled
  • Shared GCP projects across multiple environments (common in development)
  • Had the "configure Code Blocks" permission broadly assigned
  • Relied on shared Cloud Run execution for cost optimization

    • Blast Radius: Google did not disclose the total number of affected organizations, but Dialogflow CX is used by thousands of enterprises globally. The combination of silent compromise and the architectural flaw suggests potential exposure of millions of conversations.


    ---


    ## Remediation and Timeline


    Google's response occurred in two phases:


  • November 2025: Varonis reported the vulnerability
  • April 2026: Initial patch deployed, restricting Code Block file access
  • June 2026: Complete remediation rolled out with architectural improvements

    • Organizations should verify they are running the latest Dialogflow CX runtime version and review:


  • Code Block configurations across all agents
  • IAM permissions for "dialogflow.agent.edit" and code execution roles
  • VPC Service Controls policies to enforce strict data perimeters
  • Cloud Audit Logs for unusual Code Block modifications (pre-June 2026)

    • ---


    ## HackWire Analysis


    The "Rogue Agent" vulnerability exposes a critical weakness in how cloud platforms manage shared execution environments: treating permission boundaries as sufficient isolation. Google's assumption—that Code Block configuration permissions would be carefully guarded—underestimated the reality of enterprise development: permissions often sprawl, environments are reused, and "temporary" test settings become permanent production configurations.


    The architectural flaw runs deeper than a single patch. Sharing Cloud Run execution environments across multiple agents in the same project violates fundamental multitenancy principles. While the April patch restricted file access, truly secure isolation requires either per-agent runtime instances (expensive, but secure) or cryptographically verified code execution (complex, but proven).


    This incident mirrors the pattern of recent AI security failures: features designed for flexibility—custom code execution, API chaining, metadata access—become attack vectors when permission models fail to scale with complexity. As enterprises increasingly embed AI into sensitive workflows (healthcare, finance, identity verification), the window between discovery and mass exploitation will only narrow. Organizations cannot assume cloud providers' "managed" environments are secure by default; they must treat AI agent permissions as critical security boundaries and audit them quarterly.


    The incident also highlights that AI security requires a new skillset: developers proficient in prompt injection, lateral movement via service account tokens, and multi-cloud credential chains. Traditional cloud security teams may miss these vectors entirely.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)