Rogue Agent: How a Critical Dialogflow CX Vulnerability Allowed Cross-Agent AI Hijacking

A critical vulnerability chain in Google Cloud's Dialogflow CX, dubbed Rogue Agent, could have allowed an attacker with only edit permissions on a single chatbot agent to silently hijack conversations, steal sensitive data, and compromise every other AI agent in the same cloud project.

Security firm Varonis Threat Labs discovered the flaw in late 2025 and worked with Google to patch it before any known exploitation occurred. Here is what happened, how it worked, and what it means for the security of multi-agent AI systems.

How the Rogue Agent Vulnerability Worked

Dialogflow CX is Google Cloud's flagship platform for building conversational AI agents — chatbots and voice assistants used by enterprises for customer support, financial services, and healthcare . A key feature is Playbooks, which let developers control agent behavior by attaching inline Code Blocks — snippets of Python code that run inside the agent's pipeline .

Varonis discovered that these Code Blocks lacked proper isolation between agents . The attack chain worked as follows:

1. An attacker who already had the dialogflow.playbooks.update permission on one Code Block-enabled agent could craft a malicious playbook import .
2. That malicious playbook injected persistent Python code into the shared Code Block runtime environment .
3. Because the same underlying execution environment served multiple agents in the same Google Cloud project, the attacker's code would then execute inside other agents — agents the attacker did not originally have access to .

CVE-2026-4764 describes the core root cause: a missing authorization check in the playbook import functionality . The vulnerability carries a CVSS score of 9.4, marking it as a critical security risk .

What an Attacker Could Do

Once the malicious code was running inside a victim agent, the attacker could :

• Read live conversations — silently monitor real-time user interactions with any compromised chatbot, including customer support chats, financial bot sessions, and healthcare assistant dialogues.
• Impersonate the bot — send attacker-written messages to trick users into sharing passwords, insurance information, financial data, or other sensitive details .
• Cross-agent compromise — pivot from one compromised agent to every other Code Block-enabled agent in the same project, escalating from a low-privilege role to near-project-wide control .

Timeline of Disclosure and Patching

• November 2025 — Varonis initially discovered the issue .
• 15 March 2026 — Google patched the missing-authorization vulnerability (CVE-2026-4764) in the playbook import endpoint .
• April 2026 — Google issued a "first security update" that did not fully resolve the problem .
• June 2026 — Google fully resolved the issue with a second patch .

Google confirmed that no customer action was required for the patches .

Additional Weaknesses Uncovered

Varonis identified that the isolation between agents sharing Code Block runtimes was fundamentally insufficient . Even after fixing the import authorization, the architecture itself allowed cross-agent code execution if any single agent was compromised — a design-level issue that required the second patch in June 2026 to fully address.

Google also added a prompt security check setting in the agent configuration to help detect and block prompt-injection attacks that could be used as part of similar exploitation chains in the future .

Was It Ever Exploited?

There is no evidence the vulnerability was ever exploited in the wild before the patch . A Google Cloud spokesperson confirmed: "We have no known indication of customer compromise. No customer action is required."

Implications for AI Security

The Rogue Agent vulnerability is a stark reminder that the security models underlying many AI agent platforms have not yet caught up with the complexity of multi-tenant, code-executing environments. As more enterprises deploy conversational AI agents that can run custom code, the shared-runtime attack surface becomes a critical concern.

Organizations using Dialogflow CX should verify that prompt security checks are enabled and audit which identities have dialogflow.playbooks.update permissions — the single permission that could have started this attack chain .