Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots

A critical flaw in Google's Dialogflow CX could have allowed an attacker to compromise other agents within the same Google Cloud project if they had edit rights to one affected agent. The attacker could have then accessed live conversations, stolen user data, and sent messages, including those requesting password re-entry. This vulnerability was discovered by security firm Varonis. The flaw was related to Code Block-enabled agents. An attacker with the necessary permissions could have hijacked the chatbots. The vulnerability could have been exploited to read and manipulate sensitive user data.