Executive Summary
A flaw in Google Dialogflow CX could have allowed an attacker with limited edit rights to access other agents in the same Google Cloud project and manipulate their user interactions. Organizations using Code Block-enabled agents should prioritize agent isolation and access-control reviews.
What Happened
A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project. From there, they could read live conversations, steal the data users shared, and make the bots send attacker-written messages, including requests to re-enter a password. Security firm Varonis found it
Affected Products
- Google Dialogflow CX
Vulnerability / Attack Technique
Cross-agent compromise through insufficient authorization
Technical Mechanism
An attacker with edit rights on one Code Block-enabled agent could compromise other Code Block-enabled agents within the same Google Cloud project. This enabled access to live conversations and user-shared data, as well as the ability to make affected bots send attacker-written messages, including password re-entry requests.
AI Security Category
LLM06:2025 Excessive Agency
Part of the AI Agent Excessive Agency topic.
Relevant Frameworks
RealGround Analysis
The reported cross-agent access indicates that authorization and tenant or agent isolation are critical security boundaries for AI applications. Teams operating AI agents should validate that editing one agent cannot grant access to other agents, their conversations, or their outbound messaging capabilities.
Recommended Controls
- Enforce least-privilege edit permissions for Code Block-enabled agents.
- Validate isolation between agents within the same Google Cloud project.
- Restrict agent access to live conversations and user-shared data by explicit authorization boundaries.
- Require approval and integrity checks for attacker-influenced or dynamically generated bot messages.
- Test cross-agent privilege escalation and unauthorized data access during AI agent security assessments.
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/rogue-agent-flaw-could-have-let.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.