Here’s one that didn’t need prompt injection or model tricks. Security firm Varonis found a critical flaw in Google’s Dialogflow CX, and they called it Rogue Agent.
The setup: Dialogflow’s Playbooks and Code Blocks let developers add custom Python to their chatbots. All agents using Code Blocks inside the same Google Cloud project share one runtime environment. Varonis found that environment had zero isolation between agents.
An attacker with edit rights on just one agent — think malicious insider or compromised dev account — could overwrite a file inside that shared environment. That file, code_execution_env.py, runs before every Code Block execution across every agent in the project.
Once replaced, the attacker’s version handled every conversation. They could read live chats, steal data users typed, and make the bot send phishing messages asking people to re-enter passwords.
Two more issues didn’t even need the file overwrite. The environment had unrestricted outbound internet access. Using Python’s built-in urllib, an attacker could exfiltrate data straight to an external server. That bypasses VPC Service Controls entirely. The environment also exposed the Instance Metadata Service, which hands out cloud credentials. Low-privilege account in this case, but it shouldn’t be reachable at all.
Worst part? None of this showed up in customer-visible logs. No audit trail for the file change or the injected code. Google fixed it fully in June 2026, about seven months after Varonis reported it in November 2025.
No CVE was assigned. No evidence it was ever used in the wild. But if you ran Dialogflow CX agents with Code Blocks before June, audit the dialogflow.playbooks.update permission and check your logs.
The lesson here isn’t about AI models failing. It’s about shared runtimes with invisible boundaries and edit permissions that are really code execution rights in disguise.
