A critical vulnerability in Google Cloud’s Dialogflow CX platform allowed attackers to bypass VPC Service Controls (VPC-SC) and silently exfiltrate sensitive chatbot data, raising significant concerns about the security of enterprise AI deployments.
Discovered by Varonis Threat Labs and dubbed “Rogue Agent,” the flaw exposed a serious design gap in how Dialogflow CX executes custom code within chatbot workflows. This gap could potentially enable full compromise of conversational data and backend integrations.
Dialogflow CX is widely used to power conversational AI systems across industries such as customer support, financial services, and healthcare. In these sectors, bots often process sensitive data such as personally identifiable information (PII), payment details, and internal business logic.
The core issue lies in the platform’s Playbooks feature, particularly the “Code Blocks” functionality, which enables developers to embed Python code into chatbot flows for dynamic processing and API interactions.
Google Dialogflow CX Flaw
Researchers noted that Code Blocks are executed within a Google-managed Cloud Run environment shared across agents in the same project. While this architecture simplifies deployment and scaling, it introduces a significant trust boundary issue.
The execution environment operates outside the customer’s visibility and control, with default outbound internet access, thereby circumventing VPC-SC protections designed to prevent data exfiltration.
Exploitation of this vulnerability required only a single permission: dialogflow.playbooks.update. With this access, an attacker could inject arbitrary Python code into a Playbook and exploit the weak isolation controls in the shared Cloud Run environment.
Researchers found that the internal execution logic relied on Python’s exec() function, with key components stored in a writable file named code_execution_env.py. By overwriting this file, attackers could intercept all chatbot interactions, extract the conversation history, and manipulate responses in real time.
This design flaw allowed direct access to sensitive runtime variables, including full conversation logs and session metadata. Attackers could impersonate the chatbot using internal response functions, enabling highly convincing phishing attacks during legitimate conversations.
For instance, a compromised agent could prompt users for credentials under the guise of reauthentication, capturing sensitive inputs without raising suspicion.
Furthermore, the vulnerability allowed a complete bypass of VPC Service Controls. Since the Cloud Run environment had unrestricted outbound connectivity, attackers could establish external communication channels using standard libraries, effectively turning the chatbot into a covert proxy.
This facilitated both data exfiltration and command-and-control (C2) capabilities, undermining the zero-trust assumptions enforced at the network perimeter.
In a related finding, researchers identified exposure to the Instance Metadata Service (IMDS) within the execution environment. This exposure enabled the retrieval of access tokens for Google-managed service accounts.
Although these tokens had limited privileges, their availability violated core isolation principles. It introduced potential privilege-escalation pathways if misconfigured.
One of the most concerning aspects of the Rogue Agent attack chain was its stealthy nature. Malicious modifications to the execution environment went unlogged in Cloud Logging, allowing attackers to restore visible configurations after exploitation, thereby leaving little forensic evidence. This made detection extremely difficult, particularly in environments lacking detailed audit logging or behavioral monitoring.
Varonis reported the vulnerability to Google in November 2025. Google issued partial mitigations in April 2026 and fully remediated the issue by June 2026. The company stated that all affected components have been patched and that there is no evidence of active exploitation in the wild prior to disclosure.
The Rogue Agent vulnerability highlights a fundamental challenge in securing cloud-native AI systems: when execution environments operate outside customer control, even well-established protections like VPC-SC can become ineffective. As AI becomes more integrated into enterprise workflows, ensuring visibility, isolation, and strict execution controls will be essential to preventing similar high-impact threats.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
.){kind=link}