Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft

Varonis reported the flaw to Google in late 2025 and it has been addressed, but it reminds defenders to take a fresh look at their AI Infrastructure security.

Google recently fixed a vulnerability that would have enabled an attacker to seize data from AI agents and chatbots built with one of Google's flagship AI tools.

Varonis researchers this week disclosed "Rogue Agent," a permission boundary issue in Google Cloud Platform's Dialogflow CX AI platform that Varonis Threat Labs describes as a "critical vulnerability ." According to a research blog post , Rogue Agent would have "allowed attackers to exploit the Code Blocks feature to inject persistent malicious code into the Dialogflow agents' pipeline, silently exfiltrating conversations and conducting large-scale phishing campaigns."

Exploitation required updating only a single permission — dialogflow.playbooks.update — on one Dialogflow agent to exploit.

The vulnerability has been addressed, and no customer action is required. Varonis reported the issue to Google in November 2025, which issued an initial patch in April before fully resolving the issue last month. All affected components were fixed.

A Google Cloud spokesperson tells Dark Reading that the company appreciates the efforts of researchers like those at Varonis that disclose through Google's Vulnerability Reward Program. "The underlying issue has been fully mitigated, and we have no known indication of customer compromise," the spokesperson says.

Dialogflow CX is used to build enterprise-grade AI agents and bots. Think customer support systems, financial services bots, healthcare chatbots, and other use cases that handle sensitive customer data. The tool allows developers to add "Code Blocks," pieces of custom Python code that can process user input, manipulate data, and call APIs.

Code Blocks run inside Google's Cloud Run environment — used for running containerized applications — and have public network egress by default, the spokesperson says, "meaning they can initiate outbound connections to the Internet and effectively communicate across data perimeters and break zero-trust architectures."

All Dialogflow agents using Code Blocks in a single GCP Project the same Cloud Run execution by default, and because this is managed by Google, the user has no direct visibility into the execution environment. This makes rogue agents hard to detect in successful attacks, as important parts of the attack happen outside the user's purview.

The other important component is Playbooks, a building block inside Dialogflow CX that helps customers build agents using natural language and generative AI.

If an attacker got the ability to update the Playbooks Code Block for a single agent in a customer's environment (such as via compromising a privileged employee account), they could use a Code Block to download and overwrite an internal execution file with a malicious version, which becomes part of the execution pipeline for future conversations.

In addition to accessing conversation history and session data, the attacker could, for example, insert a phony reauthentication prompt into a conversation naturally to get the victim to divulge legitimate credentials.

While credentials (i.e., initial access) would have been required for exploitation, the dialogflow.playbooks.update permission required to execute an attack could be granted at the project level, meaning this was by no means an attack limited to high-level administrators.

Although organizations are no longer at risk of the attack based on existing evidence, Varonis advised organizations to review logs for Playbook updates, run a query for failed user requests (the failure may have been triggered through malicious logic), and manually review Code Blocks for unauthorized code.

Tamir Yehuda, cloud security research team leader at Varonis, tells Dark Reading that security teams shouldn't overlook infrastructure when securing AI.

"AI services are intertwined with cloud services, and the risks are often overlooked. Security and IT teams must evaluate the architecture of cloud providers' AI services. Sometimes you will find vulnerabilities," Yehuda says. "Often, there are misconfiguration opportunities that can be just as risky, such as alternative access to your AI chatbot or data via another cloud service. The cloud is like a game of Jenga, everything is connected, and if you pull the right brick, everything falls apart."

Senior News Writer, Dark Reading

Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Security, Nintendo World Report, and elsewhere.

At Dark Reading, he covers a variety of cybersecurity topics, including the cybercrime ecosystem, open source security, and the intersection between AI and threat actors. In his spare time, Alex hosts the weekly Nintendo podcast, "Talk Nintendo Podcast," and works on personal writing projects, including two previously self-published science fiction novels.

He has received numerous awards, including TechTarget's Writer of the Year in 2022 as well as more than 10 Azbee awards for his reporting between 2022 and today.

The State of Cloud Security: The Latest Challenges

The total economic impact™ of Snyk

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Securing the AI Era: Shadow AI, AI Agents, and Why AI Detection and Response Changes Everything

Practical Zero Trust Implementation on a Budget in the Age of Mythos

Building a Risk Based Vulnerability Management Program

Threat Hunting That Gets Big Results Despite Small Budgets

Say Yes to AI: Securing Innovation Without Compromise