InfoSecBulletin Cybersecurity for mankind
A critical flaw in Google Cloud Platform’s Dialogflow CX lets attackers add harmful code to a company’s AI chatbot system. The flaw, called “Rogue Agent,” was revealed by Varonis Threat Labs. It could secretly steal conversations and allow big phishing attacks, needing just one edit permission to start.
GCP Dialogflow Vulnerability
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
All agents using Code Blocks in the same GCP project share the same Cloud Run execution environment, and researchers found that a key file, code_execution_env.py, which runs Code Block logic via Python’s exec() function, was writable and lacked code restrictions.
An attacker took control of shared session data by changing this file. They could then mess with every agent’s tasks on the project. They only needed the dialogflow.playbooks.update permission, which can be limited to one agent, to set up Code Blocks and run any Python code.
Once the harmful code was saved, attackers could bring back the normal-looking settings in the console. This made the compromise hidden in Cloud Logging.
Varonis uncovered two compounding issues that amplified the risk:
VPC-SC bypass: Cloud Run’s unrestricted outbound internet access let attackers turn the execution environment into a covert data-exfiltration proxy, even when VPC Service Controls were enforced on the agent.
IMDS credential leakage: Exposure of the Instance Metadata Service allowed retrieval of access tokens tied to a Google-managed service account, violating isolation principles despite the account’s low privileges.
Varonis inform Google about the flaw in November 2025. Google released a first fix in April 2026 and completely fixed the issue by June 2026. There were no reports of it being used in attacks before the update.
Rogue Agent is now part of a list of AI-platform flaws that Varonis has shared. This follows Reprompt in Microsoft Copilot Personal and SearchLeak in Microsoft Copilot Enterprise. The last one was fixed as CVE-2026-42824 and is marked with the highest severity level.
This trend shows that about 80% of Fortune 500 companies are now using AI agents, which increases the risk on cloud platforms.
Google and Varonis suggest that organizations using Dialogflow CX with Playbook Code Blocks before the patch should do the following steps:
*Enable DATA_WRITE audit logs for the Dialogflow API and review past playbook update events for anomalies.
* Correlate suspicious updates with rare API access, unusual IP addresses, or atypical access times.
*Query Cloud Logging for failed requests and inspect
*protoPayload.status.message for exceptions tied to malicious Code Block logic.
*Manually review each agent’s Playbooks in the Dialogflow CX console to confirm only whitelisted Code Blocks are configured.
