Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft

Google recently fixed a vulnerability that would have enabled an attacker to seize data from AI agents and chatbots built with one of Google's flagship AI tools. Varonis researchers this week disclosed "Rogue Agent," a permission boundary issue in Google Cloud Platform's Dialogflow CX AI platform that Varonis Threat Labs describes as a "critical vulnerability." According to a research blog post, Rogue Agent would have "allowed attackers to exploit the Code Blocks feature to inject persistent malicious code into the Dialogflow agents' pipeline, silently exfiltrating conversations and conducting large-scale phishing campaigns." Exploitation required updating only a single permission — dialogflow.playbooks.update — on one Dialogflow agent to exploit. The vulnerability has been addressed, and no customer action is required. Varonis reported the issue to Google in November 2025, which issued an initial patch in April before fully resolving the issue last month. All affected components were fixed. A Google Cloud spokesperson tells Dark Reading that the company appreciates the efforts of researchers like those at Varonis that disclose through Google's Vulnerability Reward Program. "The underlying issue has been fully mitigated, and we have no known indication of customer compromise," the spokesperson says. Dialogflow CX is used to build enterprise-grade AI agents and bots. Think customer support systems, financial services bots, healthcare chatbots, and other use cases that handle s...