Researchers showed that confused deputy weaknesses persist in Google Cloud and Microsoft Azure, where a trusted service can be tricked into acting on an attacker's behalf against resources it should not reach. The pattern shows up when one service holds broad permissions and accepts instructions or identifiers from a less-trusted source without verifying who is really asking, which can enable cross-tenant access or privilege escalation. It is the same class of issue behind recent findings in enterprise agent and integration tooling, where a component with a user's permissions follows attacker-supplied input. The takeaway is architectural: identity and authorization must be checked at every trust boundary, not assumed from the calling service.
Varonis disclosed a now-patched flaw in Google Cloud's Dialogflow CX, the platform many companies use to build customer-service, financial, and healthcare chatbots. Because all chatbots using the platform's custom-code feature in one Google Cloud project shared a single execution environment with a writable setup file and no isolation, an attacker who could edit one agent, needing only a single low-level permission, could overwrite that file and hijack every chatbot in the project. From there they could read live conversations, steal shared data, and make bots ask for passwords. Google reported no exploitation before fixing it and no customer action is now required, but the case shows how AI features inherit cloud risks.
Aikido Security's Joe Leon has documented that standard Google Cloud API keys keep working for up to 23 minutes after they are deleted from the GCP console, with a median revocation window of 16 minutes. Over 10 trials across two days, the team kept sending authenticated requests at 3-5 per second; one trial saw 79% of requests succeed one minute after deletion. During this window, an attacker holding a leaked key retains full access to any enabled API on the project, including Gemini file dumps, BigQuery, and Maps. Google closed the bug report as 'won't fix.' Service-account deletions propagate in around 5 seconds; only standard API keys are slow.
TrustStrike Labs