InfoSecBulletin Cybersecurity for mankind
A critical flaw in Google Cloud Platform’s Dialogflow CX lets attackers add harmful code to a company’s AI chatbot system. The flaw, called “Rogue Agent,” was revealed by Varonis Threat Labs. It could secretly steal conversations and allow big phishing attacks, needing just one edit permission to start.
GCP Dialogflow Vulnerability
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
Researchers found security flaws in every script generated by ChatGPT, Copilot, and Gemini
Australian Energy Giant Origin confirms unauthorized access and disclosure of customer data
Anthropic Unveils Claude Security Plugin for Code Flaw Scanning
Apple, ASUS Router, Meta, Windmill & Ubuntu Patch Critical Security Flaws
All agents using Code Blocks in the same GCP project share the same Cloud Run execution environment, and researchers found that a key file, code_execution_env.py, which runs Code Block logic via Python’s exec() function, was writable and lacked code restrictions.
An attacker took control of shared session data by changing this file. They could then mess with every agent’s tasks on the project. They only needed the dialogflow.playbooks.update permission, which can be limited to one agent, to set up Code Blocks and run any Python code.
Once the harmful code was saved, attackers could bring back the normal-looking settings in the console. This made the compromise hidden in Cloud Logging.
Varonis uncovered two compounding issues that amplified the risk:
VPC-SC bypass: Cloud Run’s unrestricted outbound internet access let attackers turn the execution environment into a covert data-exfiltration proxy, even when VPC Service Controls were enforced on the agent.
IMDS credential leakage: Exposure of the Instance Metadata Service allowed retrieval of access tokens tied to a Google-managed service account, violating isolation principles despite the account’s low privileges.
Varonis inform Google about the flaw in November 2025. Google released a first fix in April 2026 and completely fixed the issue by June 2026. There were no reports of it being used in attacks before the update.
Rogue Agent is now part of a list of AI-platform flaws that Varonis has shared. This follows Reprompt in Microsoft Copilot Personal and SearchLeak in Microsoft Copilot Enterprise. The last one was fixed as CVE-2026-42824 and is marked with the highest severity level.
This trend shows that about 80% of Fortune 500 companies are now using AI agents, which increases the risk on cloud platforms.
Google and Varonis suggest that organizations using Dialogflow CX with Playbook Code Blocks before the patch should do the following steps:
*Enable DATA_WRITE audit logs for the Dialogflow API and review past playbook update events for anomalies.
* Correlate suspicious updates with rare API access, unusual IP addresses, or atypical access times.
*Query Cloud Logging for failed requests and inspect
*protoPayload.status.message for exceptions tied to malicious Code Block logic.
*Manually review each agent’s Playbooks in the Dialogflow CX console to confirm only whitelisted Code Blocks are configured.
