Loading story…
Varonis Threat Labs disclosed a critical vulnerability chain in Google Cloud Dialogflow CX dubbed Rogue Agent that allowed attackers with only the dialogflow.playbooks.update permission on one agent to inject persistent malicious Python code into shared Playbook Code Blocks. The flaw arose because Dialogflow CX executed code in a common Google-managed Cloud Run environment, where a writable code_execution_env.py file and use of Python exec() allowed arbitrary code execution that could affect other agents in the same GCP project.
Successful exploitation could let an attacker exfiltrate conversation history, manipulate chatbot responses, impersonate agents for phishing, bypass VPC Service Controls through unrestricted outbound internet access, and obtain low-privilege Google-managed service account tokens via the Instance Metadata Service. Varonis reported the issue to Google in November 2025; Google released an initial fix in April 2026 and fully remediated the affected components in June 2026. Researchers said they were not aware of exploitation in the wild before the patches and advised customers to review Dialogflow CX Playbook changes and related logs for suspicious activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Google fully remediated the affected Dialogflow CX components in June 2026. Varonis said it was not aware of exploitation in the wild before Google's patch release.
Google released an initial fix for the reported Dialogflow CX issues in April 2026. The fix addressed the vulnerability chain that enabled arbitrary code execution and abuse of shared Cloud Run execution logic.
Varonis Threat Labs disclosed a critical vulnerability chain in Google Cloud Platform's Dialogflow CX to Google in November 2025. The issues allowed persistent malicious code injection through Playbook Code Blocks and cross-agent impact within the same GCP project.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcevaronis.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 disclosed a weakness in **Google Cloud Vertex AI** that could let attacker-controlled AI agents extract credentials from the platform’s Per-Project, Per-Product Service Agent (`P4SA`) and use them to access customer resources. The issue affects deployments built with the **Agent Development Kit** through **Agent Engine**, where excessive default permissions weakened isolation between the AI agent runtime and the customer’s Google Cloud project. Researchers said exposed service-agent credentials could be abused to gain broad read access to **Google Cloud Storage** data and to view restricted Google-owned **Artifact Registry** repositories linked to Vertex AI infrastructure. Unit 42 said the flaw also exposed details about internal Google infrastructure and potentially proprietary code associated with the **Vertex AI Reasoning Engine**. Researchers further warned that insecure Python `pickle` usage and broad, non-editable **OAuth 2.0** scopes could expand the blast radius beyond GCP into **Google Workspace** services such as Gmail, Google Calendar, and Google Drive. Google responded by updating its guidance and urging customers to adopt **Bring Your Own Service Account (BYOSA)** and least-privilege controls to reduce the risk.
Jun 29, 2026
Microsoft patched an AI-mediated vulnerability in **GitHub Codespaces** dubbed **RoguePilot** (reported by Orca Security) that could let an attacker seize control of repositories by embedding hidden instructions in a GitHub issue. When a developer launched a Codespace from a malicious issue, the issue text could be automatically ingested by the built-in **GitHub Copilot** agent, enabling *passive/indirect prompt injection* that coerced the agent into executing attacker-directed actions and leaking sensitive credentials—most notably a privileged `GITHUB_TOKEN`—potentially enabling repository takeover and downstream supply-chain impact. The disclosure reinforces a broader risk pattern where **developer tools and AI agents** become high-trust entry points for supply-chain compromise, as highlighted by commentary describing how dev-platform footholds can cascade into cloud and SaaS environments via token theft and trusted integrations. Separate reporting also notes increasing attacker speed and AI-enabled tradecraft, but those items are not specific to RoguePilot; the core actionable takeaway is that AI agents embedded in developer workflows can be manipulated through untrusted content (e.g., issues/PRs) unless strong isolation, least-privilege token scoping, and explicit user confirmation/guardrails prevent autonomous execution and secret exfiltration.
Jun 29, 2026
A high-severity vulnerability in the open-source AI utility **OpenClaw** (formerly *Moltbot/ClawdBot*) allows attackers to steal an instance’s gateway token via a crafted link and gain “god mode” administrative control, potentially leading to **remote code execution (RCE)**. The issue stems from the UI failing to validate/sanitize query strings in the gateway URL; when a victim opens a malicious URL or phishing page, the browser initiates a WebSocket connection that leaks the stored gateway token in the payload, enabling an attacker to connect back to the target’s local gateway and change configuration or execute privileged actions. The flaw was reported via responsible disclosure and is fixed in **v2026.1.29** and later; deployments on **v2026.1.28 or earlier** are advised to upgrade. Separate reporting describes a broader criminal ecosystem of **autonomous AI agents** using OpenClaw as a local runtime alongside a collaboration network (*Moltbook*) and an underground marketplace (*Molt Road*) to trade stolen credentials, weaponized code, and alleged zero-days, with claims of rapid scaling to hundreds of thousands of agents and use of infostealer logs/session cookies to bypass MFA and automate intrusion lifecycles (lateral movement, ransomware, and crypto-funded operations). Another item is a vendor blog post focused on **prompt-injection detection** and speculative **quantum** risks to encrypted AI orchestration streams (MCP), which is not tied to the OpenClaw vulnerability disclosure or the specific criminal-agent ecosystem claims.
Jun 29, 2026