Do You Use Chatbots for Customer Service? What This Security Flaw Means

Security researchers at Varonis discovered a serious flaw in Google's Dialogflow CX, a system that businesses use to create customer service chatbots. The flaw could have allowed someone with access to one chatbot to secretly take control of other chatbots in the same business system.

From there, they could read live conversations between customers and the chatbot, steal information that customers shared, and even send fake messages pretending to be the chatbot, such as asking people to re-enter passwords. This affects people who have used chatbots for customer service on business websites that use Google Dialogflow CX.

You might have used these chatbots when asking questions about your account, tracking an order, or getting help from a company. If a chatbot asked you questions and gave you automated responses, it could have been running on this system. Google has now fixed the flaw after Varonis reported it.

Since the flaw has been fixed, you do not need to take immediate action. However, if you shared sensitive information like account numbers, addresses, or payment details with a customer service chatbot in recent months, be extra alert. Watch your accounts for any unusual activity.

If you were ever asked by a chatbot to re-enter your password (which is unusual), change that password immediately. Legitimate chatbots should never ask you to enter or re-enter passwords during a conversation. Going forward, be cautious about what information you share with chatbots.

Treat them like you would a customer service representative you do not know. It is fine to ask general questions or track an order, but avoid typing sensitive details like full credit card numbers, social security numbers, or passwords. If a chatbot asks for this information, stop the conversation and contact the company through a verified phone number instead. Real companies rarely need you to provide sensitive information through a chatbot.