Google’s Dialogflow CX platform has been patched to fix a critical vulnerability that would have allowed attackers to steal sensitive data from AI-powered chatbots and agents. The “Rogue Agent” flaw, discovered by Varonis researchers in November 2025, was a permission boundary issue that could have enabled large-scale phishing campaigns and data theft.
The vulnerability affected Dialogflow CX users who had set up Code Blocks, custom Python code that can process user input, manipulate data, and call APIs. These Code Blocks run inside Google’s Cloud Run environment, which has public network egress by default, allowing them to initiate outbound connections to the internet. This made it difficult for users to detect rogue agents in successful attacks.
Exploitation of the vulnerability required only a single permission update on one Dialogflow agent, specifically the “dialogflow.playbooks.update” permission. This meant that attackers could have gained access without needing high-level administrator credentials. Once inside, they could have accessed conversation history and session data, or even inserted malicious code to steal sensitive information.
Google fixed the issue in April 2026, but the company’s cloud security spokesperson acknowledged that it highlights the importance of reviewing AI infrastructure security. “The underlying issue has been fully mitigated, and we have no known indication of customer compromise,” they said. The spokesperson also praised Varonis for disclosing the vulnerability through Google’s Vulnerability Reward Program.
Varonis researchers warn that security teams should not overlook infrastructure when securing AI-powered systems. They recommend reviewing logs for Playbook updates, running queries for failed user requests, and manually reviewing Code Blocks for unauthorized code. This is particularly important for organizations using Dialogflow CX to build customer support systems, financial services bots, or healthcare chatbots.
The Rogue Agent flaw serves as a reminder that AI infrastructure security is just as critical as traditional cybersecurity measures. As more organizations adopt AI-powered solutions, they must ensure that these systems are properly secured to prevent data breaches and other malicious activities. By reviewing their AI infrastructure and taking proactive steps to address vulnerabilities, organizations can reduce the risk of falling victim to sophisticated attacks like Rogue Agent.
In light of this incident, it’s essential for security teams to take a fresh look at their AI infrastructure security. This includes regularly reviewing logs, updating permissions, and ensuring that Code Blocks are properly secured. By doing so, they can prevent unauthorized access and protect sensitive data from being stolen by rogue agents.
Source: Dark Reading — 2026-07-07