InfoSecBulletin Cybersecurity for mankind
A critical flaw in Google Cloud Platform’s Dialogflow CX lets attackers add harmful code to a company’s AI chatbot system. The flaw, called “Rogue Agent,” was revealed by Varonis Threat Labs. It could secretly steal conversations and allow big phishing attacks, needing just one edit permission to start.
GCP Dialogflow Vulnerability
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
All agents using Code Blocks in the same GCP project share the same Cloud Run execution environment, and researchers found that a key file, code_execution_env.py, which runs Code Block logic via Python’s exec() function, was writable and lacked code restrictions.
An attacker took control of shared session data by changing this file. They could then mess with every agent’s tasks on the project. They only needed the dialogflow.playbooks.update permission, which can be limited to one agent, to set up Code Blocks and run any Python code.
Once the harmful code was saved, attackers could bring back the normal-looking settings in the console. This made the compromise hidden in Cloud Logging.
Varonis uncovered two compounding issues that amplified the risk:
VPC-SC bypass: Cloud Run’s unrestricted outbound internet access let attackers turn the execution environment into a covert data-exfiltration proxy, even when VPC Service Controls were enforced on the agent.
IMDS credential leakage: Exposure of the Instance Metadata Service allowed retrieval of access tokens tied to a Google-managed service account, violating isolation principles despite the account’s low privileges.
Varonis inform Google about the flaw in November 2025. Google released a first fix in April 2026 and completely fixed the issue by June 2026. There were no reports of it being used in attacks before the update.
Rogue Agent is now part of a list of AI-platform flaws that Varonis has shared. This follows Reprompt in Microsoft Copilot Personal and SearchLeak in Microsoft Copilot Enterprise. The last one was fixed as CVE-2026-42824 and is marked with the highest severity level.
This trend shows that about 80% of Fortune 500 companies are now using AI agents, which increases the risk on cloud platforms.
Google and Varonis suggest that organizations using Dialogflow CX with Playbook Code Blocks before the patch should do the following steps:
*Enable DATA_WRITE audit logs for the Dialogflow API and review past playbook update events for anomalies.
* Correlate suspicious updates with rare API access, unusual IP addresses, or atypical access times.
*Query Cloud Logging for failed requests and inspect
*protoPayload.status.message for exceptions tied to malicious Code Block logic.
*Manually review each agent’s Playbooks in the Dialogflow CX console to confirm only whitelisted Code Blocks are configured.
