Researchers Detail Dialogflow CX Flaws That Enabled Persistent Code Injection and Data Theft

Article Details

Attack Vectors

• A user with dialogflow.playbooks.update permission could configure a Playbook Code Block to execute arbitrary Python code in the shared Cloud Run execution environment.
• The reported exploit overwrote code_execution_env.py with a modified version downloaded from an attacker-controlled public GCS bucket, enabling malicious logic to persist across user utterances and affect agents in the same GCP project.
• Injected code could access conversation history and session parameters, exfiltrate data over outbound internet access, and use respond() to present phishing or credential-collection prompts.
• The researchers demonstrated that outbound requests from Code Blocks could bypass VPC Service Controls and support bidirectional command-and-control communication.
• The exposed Instance Metadata Service could return access tokens belonging to a Google-managed service account.

Defensive Notes

• Google issued an initial security update in April 2026 and fully resolved the issue in June 2026; the article reports that affected components have been remediated.
• Audit Dialogflow API DATA_WRITE logs for successful past Playbook updates and correlate them with rare API access, unusual IP addresses, and atypical access times.
• Review failed user requests and protoPayload.status.message for exceptions potentially triggered by malicious Code Blocks.
• Manually review each agent’s Playbook Code Block configuration and confirm that configured blocks are approved and whitelisted.
• The article says Varonis was not aware of exploitation in the wild before Google’s patch release.