Rogue Agent: How a Critical Dialogflow CX Vulnerability Allowed Cross-Agent AI Hijacking

1. An attacker who already had the dialogflow.playbooks.update permission on one Code Block-enabled agent could craft a malicious playbook import ^DN.
2. That malicious playbook injected persistent Python code into the shared Code Block runtime environment ^V.
3. Because the same underlying execution environment served multiple agents in the same Google Cloud project, the attacker's code would then execute inside other agents — agents the attacker did not originally have access to ^V.

CVE-2026-4764 describes the core root cause: a missing authorization check in the playbook import functionality ^ND. The vulnerability carries a CVSS score of 9.4, marking it as a critical security risk ^L.

What an Attacker Could Do

Once the malicious code was running inside a victim agent, the attacker could ^V:

• Read live conversations — silently monitor real-time user interactions with any compromised chatbot, including customer support chats, financial bot sessions, and healthcare assistant dialogues.
• Impersonate the bot — send attacker-written messages to trick users into sharing passwords, insurance information, financial data, or other sensitive details ^VA.
• Cross-agent compromise — pivot from one compromised agent to every other Code Block-enabled agent in the same project, escalating from a low-privilege role to near-project-wide control ^V.

Timeline of Disclosure and Patching

• November 2025 — Varonis initially discovered the issue ^A.
• 15 March 2026 — Google patched the missing-authorization vulnerability (CVE-2026-4764) in the playbook import endpoint ^DN.
• April 2026 — Google issued a "first security update" that did not fully resolve the problem ^A.
• June 2026 — Google fully resolved the issue with a second patch ^AA.

Google confirmed that no customer action was required for the patches ^D.

Additional Weaknesses Uncovered

Varonis identified that the isolation between agents sharing Code Block runtimes was fundamentally insufficient ^V. Even after fixing the import authorization, the architecture itself allowed cross-agent code execution if any single agent was compromised — a design-level issue that required the second patch in June 2026 to fully address.

Google also added a prompt security check setting in the agent configuration to help detect and block prompt-injection attacks that could be used as part of similar exploitation chains in the future ^VD.

Was It Ever Exploited?

There is no evidence the vulnerability was ever exploited in the wild before the patch ^A. A Google Cloud spokesperson confirmed: "We have no known indication of customer compromise. No customer action is required." ^A

Implications for AI Security

The Rogue Agent vulnerability is a stark reminder that the security models underlying many AI agent platforms have not yet caught up with the complexity of multi-tenant, code-executing environments. As more enterprises deploy conversational AI agents that can run custom code, the shared-runtime attack surface becomes a critical concern.

Organizations using Dialogflow CX should verify that prompt security checks are enabled ^D and audit which identities have dialogflow.playbooks.update permissions — the single permission that could have started this attack chain ^V.