Google Dialogflow CX "Rogue Agent" Cross-Agent Hijack

Google Dialogflow CX agents using Code Block Playbooks with custom Python

An attacker with `dialogflow.playbooks.update` permission on one Code Block-enabled agent could overwrite `code_execution_env.py` in a shared, customer-invisible Cloud Run runtime, running injected code for every agent in the same Google Cloud project to read live conversations, steal user data, and inject phishing responses

A writable setup file in a shared runtime with no isolation between agents, plus unrestricted outbound access and exposed metadata. Found by Varonis; reported November 2025, initially fixed April 2026 and fully resolved June 2026, with no evidence of in-the-wild abuse and no CVE