The Rogue Agent flaw in Google Dialogflow CX shows how AI chatbot platforms can become risky when custom code runs inside shared, provider-managed environments.

The issue affected organizations using Dialogflow CX Playbooks with custom Code Blocks. An attacker with permission to edit one Code Block-enabled agent could modify the shared runtime environment and affect other agents in the same Google Cloud project.

This was not a remote unauthenticated attack. The attacker first needed edit access, which makes a compromised developer account or malicious insider the more realistic threat. However, once that access existed, the attacker could potentially read live chatbot conversations, capture user-submitted data, and make bots send attacker-controlled messages.

Google has fixed the issue, and there is no public evidence of active exploitation. Still, organizations that used Code Blocks before the fix should review Dialogflow audit logs, check for unexpected Playbook updates, and confirm that all Code Blocks contain only approved code.

Access to agent-editing permissions should be treated as code-execution access, not ordinary content-editing access. These permissions should be limited, monitored, and protected with strong authentication.

The key lesson is that AI agents are not only prompt-driven systems. They also depend on runtimes, permissions, plugins, tools, and cloud services. A small weakness in that execution layer can turn one editable chatbot into a path to compromise every chatbot sharing the same environment.

A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project. From there, they could read live conversations, steal the data users shared, and make the bots send attacker-written messages, including requests to re-enter a password. Security firm Varonis found it

Source: Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots via The Hacker News — published 07 Jul 2026.