Home / Technology / Critical flaw lets hackers control Google's AI bots
Critical flaw lets hackers control Google's AI bots
13 Jul
Summary
- Flaws in Google Cloud Dialogflow CX allowed agent takeover.
- Malicious code blocks could steal chat logs and credentials.
- Google patched the vulnerability between April and June 2026.
Security researchers recently uncovered critical vulnerabilities within Google Cloud's Dialogflow CX platform. These flaws enabled threat actors to gain control of AI agents, access sensitive chat logs, and steal user credentials. The conversational AI platform allows developers to integrate custom Python snippets, known as Code Blocks, into their chatbots.
These Code Blocks are executed within a shared Google-managed Cloud Run service. Researchers found that a writable filesystem, public internet access, and excessive privileges in this environment facilitated attacks. A single compromised agent could control all other agents in a Google Cloud project due to the shared nature of the service.
Varonis reported the discovery to Google in November 2025. The tech giant issued an initial fix in April 2026, with the vulnerability fully resolved by June 2026. While no in-the-wild exploitation has been reported, users are advised to review audit logs and inspect Code Blocks for unauthorized code.
