The editing resolution of one chatbot turned out to be the key to the entire system: the vulnerability of Rogue Agent in Google Dialogflow CX allowed an attacker with access to one agent to intercept the rest of the agents with blocks of code in the same Google Cloud project.
According to the data Varonis, the problem affected organizations that created agents through Playbooks and added their own code to Python. A remote attack without a record was impossible. To enter, the right dialogflow.playbooks.update was required, so an unscrupulous employee or attacker who hacked the developer’s account could apply the vulnerability.
All agents with code blocks within one project used the general Cloud Run environment. Experts found that the code of one agent could affect the components common to other agents in the same project. As a result, an attacker with the right rights could achieve the execution of his code when starting related chatbots.
Such an attack could open access to the history of conversations, the session and the mechanism of formation of answers. In the test environment, experts confirmed the possibility of intercepting correspondence and changing messages that the user saw. The return of the source code block through the console did not eliminate the consequences of the attack, as the changes made continued to operate in the overall environment.
Varonis also found that the environment could access external resources and internal services of the project. At the same time, suspicious changes were almost not reflected in the client’s logs, so it was difficult for administrators to detect interference.
Experts told Google about the problem in November 2025. The company released its first fix in April 2026, but completely closed the vulnerability only in June. The CVE identifier was not appropriated, signs of real use of the attack were not found.
Organizations that have used Code Blocks are advised to check users with the right dilogflow.playbooks.update, to review Playbooks changes logs, compare suspicious actions with users, IP addresses and access time, and manually check all blocks of code in the Dialogflow CX.
According to the data Varonis, the problem affected organizations that created agents through Playbooks and added their own code to Python. A remote attack without a record was impossible. To enter, the right dialogflow.playbooks.update was required, so an unscrupulous employee or attacker who hacked the developer’s account could apply the vulnerability.
All agents with code blocks within one project used the general Cloud Run environment. Experts found that the code of one agent could affect the components common to other agents in the same project. As a result, an attacker with the right rights could achieve the execution of his code when starting related chatbots.
Such an attack could open access to the history of conversations, the session and the mechanism of formation of answers. In the test environment, experts confirmed the possibility of intercepting correspondence and changing messages that the user saw. The return of the source code block through the console did not eliminate the consequences of the attack, as the changes made continued to operate in the overall environment.
Varonis also found that the environment could access external resources and internal services of the project. At the same time, suspicious changes were almost not reflected in the client’s logs, so it was difficult for administrators to detect interference.
Experts told Google about the problem in November 2025. The company released its first fix in April 2026, but completely closed the vulnerability only in June. The CVE identifier was not appropriated, signs of real use of the attack were not found.
Organizations that have used Code Blocks are advised to check users with the right dilogflow.playbooks.update, to review Playbooks changes logs, compare suspicious actions with users, IP addresses and access time, and manually check all blocks of code in the Dialogflow CX.
