2026-07-07 · 2026-Q3
Google Dialogflow CX "Rogue Agent" Cross-Agent Hijack
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Google Dialogflow CX agents using Code Block Playbooks with custom Python
Impact
An attacker with `dialogflow.playbooks.update` permission on one Code Block-enabled agent could overwrite `code_execution_env.py` in a shared, customer-invisible Cloud Run runtime, running injected code for every agent in the same Google Cloud project to read live conversations, steal user data, and inject phishing responses
Root cause
A writable setup file in a shared runtime with no isolation between agents, plus unrestricted outbound access and exposed metadata. Found by Varonis; reported November 2025, initially fixed April 2026 and fully resolved June 2026, with no evidence of in-the-wild abuse and no CVE
Sources
Catalog
Cite this: AgentProv incident record: Google Dialogflow CX "Rogue Agent" Cross-Agent Hijack (2026-07-07). https://agentprov.com/incidents/2026-07-07-google-dialogflow-cx-rogue-agent-cross-agent-hijack
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run