The "Rogue Agent" vulnerability in Google Cloud Dialogflow CX arises from the shared Cloud Run environment used to execute Code Blocks containing Python logic. Attackers with permission to configure Code Blocks could overwrite a critical Python file executed via exec(), injecting malicious code that gains full visibility and control over ongoing conversations. This enables silent manipulation of AI conversations, session hijacking, impersonation, and data exfiltration. The attack bypasses logging and can persistently modify the execution environment across all agents in the same Google Cloud project. Additionally, attackers could establish bidirectional communication channels bypassing VPC Service Controls and retrieve access tokens from the Instance Metadata Service. Google released an initial patch in April 2026 and a complete fix in June 2026 after Varonis reported the issue in November 2025.

Attackers could silently control and manipulate AI conversations across all Dialogflow CX agents within the same Google Cloud project, exfiltrate sensitive user data, hijack sessions, impersonate legitimate conversation flows, and deploy persistent malicious code without detection. The vulnerability also allowed bypassing of network perimeter controls and access token theft, posing a significant risk to confidentiality and integrity of AI-driven workflows.

A complete fix for this vulnerability was deployed by Google in June 2026, following an initial patch in April 2026. Organizations using Dialogflow CX should ensure their environments are updated with the latest patches. Since this is a cloud-hosted service, Google manages remediation server-side. Users should verify that their Google Cloud projects have received these updates and review permissions related to Code Blocks configuration to minimize risk.