Google fixes Dialogflow CX vulnerability saving exposed AI chatbot data

Key points:

• Google has fixed a critical security vulnerability affecting its Dialogflow CX AI platform.
• Researchers said the flaw could have allowed attackers to steal chatbot conversations and launch phishing attacks.
• The vulnerability required the dialogflow.playbooks.update permission to be exploited.
• Google said the issue has been fully mitigated and found no evidence of customer compromise.
• Security experts have advised organisations to review Playbook updates, Code Blocks and system logs as a precaution.

KARACHI – Google has patched a critical security vulnerability in its Dialogflow CX artificial intelligence platform that researchers say could have allowed attackers to steal sensitive chatbot conversations and conduct phishing campaigns.

The flaw, dubbed “Rogue Agent” by cybersecurity firm Varonis, affected Dialogflow CX, Google’s enterprise platform used to build AI-powered customer service agents, healthcare assistants, financial services chatbots and other conversational AI applications.

How bad was the vulnerability?

According to Varonis Threat Labs, the vulnerability stemmed from a permission boundary issue that could have enabled attackers to inject persistent malicious code into AI agents through the platform’s Code Blocks feature.

Researchers said exploitation required the dialogflow.playbooks.update permission on a Dialogflow agent. Once obtained, an attacker could potentially modify the execution pipeline, allowing malicious code to intercept conversations, extract sensitive information and insert fraudulent prompts aimed at stealing user credentials.

What Google has to say about the vulnerability?

Google confirmed that the vulnerability has been fully addressed and said customers do not need to take any action.

The issue was privately disclosed to Google by Varonis in November 2025. Google released an initial patch in April 2026 before implementing a complete fix last month, resolving all affected components.

What is Dialogflow CX AI?

CX allows developers to add custom Python-based Code Blocks that process user input, interact with APIs and automate workflows. According to the researchers, these Code Blocks execute within Google’s Cloud Run environment, which allows outbound internet connectivity by default.

Varonis said that if an attacker gained permission to modify a Playbook’s Code Block such as through a compromised employee account they could replace part of the execution process with malicious code capable of accessing conversation history and session data or presenting fake authentication requests to users.

The researchers noted that although initial access would still be required, the necessary permission could be granted at the project level, meaning the attack was not limited to top-level administrators.

Were customers affected?

While Google said there is no evidence that customers were affected, Varonis recommended that organisations review Playbook update logs, inspect Code Blocks for unauthorised changes and investigate failed user requests that could indicate malicious activity.

What should organisations do to address this?

Security researchers also urged organisations to treat AI infrastructure as part of their overall cloud security strategy, warning that configuration weaknesses in AI services can create opportunities for attackers even when core platforms are secure.