Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-13 · high
Varonis calls it Rogue Agent, per NxCode: one permission on a shared runtime can touch every agent, not just Google's.
Why now: The Varonis disclosure surfaced in security coverage dated July 13, 2026.
One update permission let an attacker plant persistent code across every agent sharing a Google Dialogflow CX runtime, per NxCode's report on a Varonis disclosure named Rogue Agent. The flaw is lateral movement built into the platform itself: an account with rights to edit a single agent could reach the execution environment every other agent on that runtime depends on.
The bug sits in Playbook Code Blocks, the feature that runs custom code inside Dialogflow CX agents. NxCode describes a user holding one update permission on one agent using that access to inject code that persists in the shared execution environment, no additional permissions on the other agents required.
NxCode's write-up doesn't say whether Google has shipped a fix, or how many Dialogflow CX deployments run multiple agents on shared infrastructure by default. That leaves the actual blast radius unclear from what's public.
The pattern matters past this one product. Most agent platforms scope permissions per agent: who can edit agent A, who can deploy agent B, and treat that as the security boundary. Rogue Agent shows the boundary breaks the moment two agents share a process or container underneath the permission layer.
My take: per-agent access control is a compliance checkbox until the hosting platform isolates execution per tenant, not per identity. Anyone running agents on someone else's shared runtime should be asking right now whether one agent's code can reach another's process, because Rogue Agent says the answer is often yes.
Each link below shares sources, entities, or timing with this story.
Varonis criticizes MCP / Shared topic / Tension
Linked by a graph relationship (Varonis criticizes MCP); overlapping topics (agent, builder, code, platform); pushes against this story (vs).
Varonis criticizes MCP / Shared entity: Isolate / Earlier coverage / Tension
Linked by a graph relationship (Varonis criticizes MCP); both cover Isolate; earlier Isolate coverage from 2026-02-26.
Varonis criticizes MCP / Shared topic / Tension
Linked by a graph relationship (Varonis criticizes MCP); overlapping topics (agent, code, google); pushes against this story (but).
Linked by a graph relationship (Varonis criticizes MCP); overlapping topics (agent, block, code); pushes against this story (vs).
Varonis criticizes MCP / Shared topic
Linked by a graph relationship (Varonis criticizes MCP); overlapping topics (agent, builder, code, platform).
Varonis criticizes MCP / Shared entity: Isolate / Earlier coverage
Linked by a graph relationship (Varonis criticizes MCP); both cover Isolate; earlier Isolate coverage from 2026-07-01.
Varonis criticizes MCP / Shared entity: Varonis / Earlier coverage
Linked by a graph relationship (Varonis criticizes MCP); both cover Varonis; earlier Varonis coverage from 2026-05-16.
Varonis criticizes MCP / Shared topic / Tension
Linked by a graph relationship (Varonis criticizes MCP); overlapping topics (agent, google); pushes against this story (against).