The "Rogue Agent" vulnerability could have enabled attackers to silently manipulate AI conversations, exfiltrate data, and compromise every Dialogflow CX agent within the same Google Cloud project.

Is your feature or enhancement related to a problem? Please describe. Chatwoot already supports chatbot integrations like Dialogflow and its own Captain AI agent for automating responses, but these...

A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX. Dialogflow agent developers with Webhook editor permission are able to configure Webhooks using Dialogflow service agent access token authentication. This allows the attacker to escalate their privileges from agent-level to project-level, granting them unauthorized access to manage resources in services …

How to moderate online content with a Google Conversational Agent. Perspective API isn't enough by itself. Discusses Dialogflow

CircleCI is the world’s largest shared continuous integration and continuous delivery (CI/CD) platform, and the central hub where code moves from idea to delivery.

  Google has patched a security vulnerability in its Dialogflow CX platform that could have allowed attackers to steal sensitive conversations from AI-powered chatbots and deploy phishing attacks by abusing a permissions loophole. The flaw, dubbed "Rogue Agent" by researchers at Varonis Threat Labs, impacted Google Cloud Platform's Dialogflow CX, a service widely used to build enterprise AI agents for customer support, financial services, healthcare, and other applications that process sensitive user information. According to Varonis, the vulnerability stemmed from a permission boundary issue that could have enabled attackers to inject persistent malicious code into Dialogflow agents through the platform's Code Blocks feature. Successful exploitation required only the dialogflow.playbooks.update permission on a single Dialogflow agent. Researchers said the malicious code could have silently captured chatbot conversations, accessed session data, and even facilitated phishing campaigns by inserting fraudulent authentication prompts into ongoing conversations. Google has confirmed that the vulnerability has been fully addressed and stated that no customer action is required. Varonis initially reported the issue to Google in November 2025. Google released an initial fix in April before completing the mitigation last month across all affected components. A Google Cloud spokesperson acknowledged the researchers' responsible disclosure efforts through Google's Vulnerability Reward Program. "The underlying issue has been fully mitigated, and we have no known indication of customer compromise," the spokesperson said. Dialogflow CX allows developers to enhance AI agents using custom Python-based Code Blocks that process user inputs, manipulate information, and interact with external APIs. These Code Blocks execute within Google's Cloud Run environment, which supports outbound internet connectivity by default. Because multiple Dialogflow agents within the same Google Cloud project share a common Cloud Run execution environment managed by Google, malicious modifications could have remained difficult for customers to detect, as critical parts of the execution pipeline are not directly visible. Another key component involved is Playbooks, a Dialogflow CX feature that helps developers create AI agents using natural language and generative AI. If an attacker gained the ability to modify a Playbook's Code Block—potentially by compromising an account with sufficient privileges—they could replace internal execution files with malicious versions that would persist across future chatbot interactions. Beyond accessing conversation history, attackers could have manipulated chatbot responses to display fake reauthentication prompts, increasing the likelihood of users unknowingly disclosing valid credentials. Although exploitation required initial access, such as compromised credentials, researchers noted that the required dialogflow.playbooks.update permission could be assigned at the project level, meaning the threat was not limited to highly privileged administrators. While the issue has been resolved, Varonis recommends organizations review Playbook update logs, investigate failed user requests that could indicate malicious activity, and manually inspect Code Blocks for unauthorized changes. Tamir Yehuda, cloud security research team leader at Varonis, urged organizations to pay closer attention to AI infrastructure security. "AI services are intertwined with cloud services, and the risks are often overlooked. Security and IT teams must evaluate the architecture of cloud providers' AI services. Sometimes you will find vulnerabilities," Yehuda says. "Often, there are misconfiguration opportunities that can be just as risky, such as alternative access to your AI chatbot or data via another cloud service. The cloud is like a game of Jenga, everything is connected, and if you pull the right brick, everything falls apart."

Varonis reported the flaw to Google in late 2025 and it has been addressed, but it reminds defenders to take a look at their AI Infrastructure security.