A Critical Flaw in Google’s Dialogflow CX Exposed AI Chatbots to Data Theft
Google has recently patched a critical vulnerability in its Dialogflow CX platform that would have allowed attackers to steal sensitive data from AI-powered chatbots and agents. The flaw, dubbed “Rogue Agent,” was discovered by Varonis researchers and reported to Google in November 2025. Although the issue has been fully addressed, it serves as a stark reminder for organizations to take a closer look at their AI infrastructure security.
The vulnerability, which has now been fixed, would have enabled an attacker to inject malicious code into the Dialogflow agents’ pipeline, allowing them to silently exfiltrate conversations and conduct large-scale phishing campaigns. To exploit this flaw, an attacker needed only to update a single permission on one Dialogflow agent – dialogflow.playbooks.update. This means that even non-administrators could have potentially fallen victim to such an attack.
Dialogflow CX is a powerful tool used by organizations to build enterprise-grade AI agents and bots. These chatbots handle sensitive customer data, making them a prime target for attackers. The platform’s Code Blocks feature allows developers to add custom Python code that can process user input, manipulate data, and call APIs. However, this feature also comes with some security concerns. By default, Code Blocks have public network egress, allowing them to initiate outbound connections to the internet and potentially break zero-trust architectures.
The Dialogflow CX architecture makes it challenging for users to detect rogue agents in successful attacks. Because all Dialogflow agents using Code Blocks share the same Cloud Run execution environment by default, attackers can inject malicious code without being detected. This highlights the importance of monitoring logs and Code Blocks for unauthorized activity.
While Google has now fully mitigated the issue, organizations should take this as an opportunity to review their AI infrastructure security. Varonis advises reviewing logs for Playbook updates, running queries for failed user requests, and manually reviewing Code Blocks for unauthorized code. As Tamir Yehuda, cloud security research team leader at Varonis, emphasizes, “security teams shouldn’t overlook infrastructure when securing AI.” By taking a closer look at their AI-powered systems and implementing robust security measures, organizations can protect themselves against similar vulnerabilities in the future.
In practical terms, this means that IT teams should prioritize monitoring and logging for AI-related activity, including Code Blocks and Playbooks. Regularly reviewing these logs can help identify potential security issues before they become major problems. Additionally, organizations should ensure that all users have the necessary permissions to access and update their Dialogflow agents, minimizing the risk of unauthorized code injection. By taking these steps, organizations can better protect themselves against AI-related security threats and maintain the trust of their customers.
Source: Dark Reading — 2026-07-07