InfoSecBulletin Cybersecurity for mankind
A critical flaw in Google Cloud Platform’s Dialogflow CX lets attackers add harmful code to a company’s AI chatbot system. The flaw, called “Rogue Agent,” was revealed by Varonis Threat Labs. It could secretly steal conversations and allow big phishing attacks, needing just one edit permission to start.
GCP Dialogflow Vulnerability
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
All agents using Code Blocks in the same GCP project share the same Cloud Run execution environment, and researchers found that a key file, code_execution_env.py, which runs Code Block logic via Python’s exec() function, was writable and lacked code restrictions.
An attacker took control of shared session data by changing this file. They could then mess with every agent’s tasks on the project. They only needed the dialogflow.playbooks.update permission, which can be limited to one agent, to set up Code Blocks and run any Python code.
Once the harmful code was saved, attackers could bring back the normal-looking settings in the console. This made the compromise hidden in Cloud Logging.
Varonis uncovered two compounding issues that amplified the risk:
VPC-SC bypass: Cloud Run’s unrestricted outbound internet access let attackers turn the execution environment into a covert data-exfiltration proxy, even when VPC Service Controls were enforced on the agent.
IMDS credential leakage: Exposure of the Instance Metadata Service allowed retrieval of access tokens tied to a Google-managed service account, violating isolation principles despite the account’s low privileges.
Varonis inform Google about the flaw in November 2025. Google released a first fix in April 2026 and completely fixed the issue by June 2026. There were no reports of it being used in attacks before the update.
Rogue Agent is now part of a list of AI-platform flaws that Varonis has shared. This follows Reprompt in Microsoft Copilot Personal and SearchLeak in Microsoft Copilot Enterprise. The last one was fixed as CVE-2026-42824 and is marked with the highest severity level.
This trend shows that about 80% of Fortune 500 companies are now using AI agents, which increases the risk on cloud platforms.
Google and Varonis suggest that organizations using Dialogflow CX with Playbook Code Blocks before the patch should do the following steps:
*Enable DATA_WRITE audit logs for the Dialogflow API and review past playbook update events for anomalies.
* Correlate suspicious updates with rare API access, unusual IP addresses, or atypical access times.
*Query Cloud Logging for failed requests and inspect
*protoPayload.status.message for exceptions tied to malicious Code Block logic.
*Manually review each agent’s Playbooks in the Dialogflow CX console to confirm only whitelisted Code Blocks are configured.
