Varonis Threat Labs discovered “Rogue Agent,” a critical Dialogflow CX flaw in Google Cloud Platform that let attackers inject persistent malicious code, exfiltrate conversations, and launch phishing campaigns from a single edit permission. Google patched the issue in 2026, and Varonis also identified related VPC-SC bypass and IMDS credential leakage weaknesses that could expand the impact of compromised agents. #RogueAgent #DialogflowCX #GoogleCloudPlatform #VaronisThreatLabs #VPCServiceControls #IMDS
Keypoints
- Varonis Threat Labs discovered a critical vulnerability in Google Cloud Platform’s Dialogflow CX service, named Rogue Agent.
- The flaw allowed attackers to abuse Playbook Code Blocks to inject persistent malicious Python code into the agent execution pipeline.
- Successful exploitation could silently exfiltrate conversations, hijack sessions, manipulate workflows, and drive large-scale phishing attacks.
- Only one permission was needed to start the attack: dialogflow.playbooks.update on a single agent.
- Because Code Blocks ran in a shared Google-managed Cloud Run environment, one compromised agent could affect others in the same GCP project.
- Varonis and Google said affected components were remediated, with an initial security update in April 2026 and full resolution in June 2026.
- The report also described two additional issues: a VPC-SC bypass through outbound internet access and credential exposure via IMDS in Cloud Run.
MITRE Techniques
- [T1059.006] Command and Scripting Interpreter: Python – Attackers abused Playbook Code Blocks to run arbitrary Python code in the Dialogflow execution environment (’embed custom Python logic directly into conversation flows’ / ‘execute arbitrary Python code by design’).
- [T1055] Process Injection / Execution Hijacking – The injected code was appended into internal system code and executed in the same scope, letting attackers hijack session behavior (‘the configured Code Block was simply appended to internal system code before being passed to the exec() function’).
- [T1005] Data from Local System – The attacker enumerated files in the Cloud Run filesystem to find the execution file and overwrite it (‘Enumeration of the Python files in Cloud Run’s filesystem revealed a key file named code_execution_env.py’).
- [T1027] Obfuscated Files or Information – Malicious logic was persisted by modifying the execution environment and restoring the visible configuration to appear normal (‘the attacker could restore the original Code Block configuration … Meanwhile, the malicious code persisted’).
- [T1078] Valid Accounts – The attack began with legitimate granted access using a single editable permission on one agent (‘requires a single edit permission known as dialogflow.playbooks.update on one agent’).
- [T1090] Proxy – Cloud Run’s outbound access was abused as a covert proxy to bypass perimeter controls and relay data externally (‘turning the Cloud Run Service into a covert proxy for data exfiltration’).
- [T1041] Exfiltration Over C2 Channel – The attacker established bidirectional communication to an external server for data theft and remote control (‘using preinstalled libraries such as urllib, we established a bidirectional communication channel’).
- [T1566] Phishing – The attacker used the agent to present fake reauthentication prompts and steal credentials (‘Injected phishing prompts disguised as legitimate reauthentication requests from the agent’).
Indicators of Compromise
- [Permission/Access Control ] required to configure the malicious feature – dialogflow.playbooks.update, project-level agent-scoped permission
- [File Name ] overwritten execution environment file – code_execution_env.py, modified version of code_execution_env.py
- [Cloud Service / Path ] malicious hosting and overwrite source – attacker-controlled public GCS bucket, Google-managed Cloud Run service
- [Python Function / API ] code execution mechanism referenced in the exploit – exec(), respond()
- [Library / Network Tool ] used for outbound communication and exfiltration – urllib, access to an attacker-controlled server
- [Cloud Logging / Audit Events ] investigation targets for suspicious activity – DATA_WRITE Audit Logs for the Dialogflow API, failed user requests in Cloud Logging
- [Cloud Identity / Metadata ] leaked credential source – IMDS, access tokens for a Google-managed service account
Read more: https://www.varonis.com/blog/rogue-agent-dialogflow-attack