Dialogflow CX code block flaw lets attackers hijack all agents in a project
A single edit permission (dialogflow.playbooks.update) lets a malicious code block overwrite a shared Cloud Run file, executing arbitrary Python across every Dialogflow CX agent in a GCP project. The bug exposed conversation data and enabled phishing at scale, prompting Google to patch the issue in June 2026.