The original text is in EN, taken from the source site. Source ↗

An attacker used an exposed Flowise AI orchestration server to enumerate workflows, harvest credentials, and try to turn its language-model agent into an offensive analysis assistant.

Sekoia says the findings were first shared in a private FLINT report on 7 September 2026.

The honeypot emulated Flowise 2.2.8 and captured requests without running real system code or a language model. The attacker first checked the service and version, then queried APIs listing chatflows and stored credentials.

Requests to individual credential records sought API keys and database connection details.

The behavior resembled an authentication-bypass flaw, but Sekoia explicitly says the activity did not demonstrate exploitation of CVE-2024-31621: that issue was fixed in Flowise 1.6.6 and was cited only as a behavior comparison.

After a roughly two-hour pause, the operator returned to probe a wider range of APIs and test inference routes.

They then tried to rename an existing workflow and create a new “System Status” chatflow containing an HTTP Request node pointed at attacker infrastructure.

If executed, the flow could make the server send an outbound callback. This was an attempt to abuse legitimate workflow functionality not proof that the attacker achieved code execution or persistence.

The sequence combined automated endpoint discovery with more tailored prompts, suggesting an initial scanner followed by hands-on interaction.

The honeypot’s simulated responses and canary credentials helped researchers observe the attempts; because it did not run a real model or system code, the investigation does not establish that secrets were actually stolen from a production Flowise deployment.

Exploitation attempts targeting several known vulnerabilities, including the CustomMCP remote code execution vulnerability (CVE-2025-59528), the CSV Agent remote code execution vulnerability (CVE-2026-41264), and authentication bypass and credential disclosure flaws similar to CVE-2024-31621.

Flowise honeypot attack timeline (Source : Sekoia).

Sekoia Researchers observed that, the activity, observed against a honeypot in late August 2026, illustrates how platforms that connect models to secrets, databases and external tools can become valuable targets.

The attacker also sent prompts designed to override instructions, expose system prompts or conversation history, probe available tools and retrieve information from a simulated finance RAG workflow.

RAG, or retrieval-augmented generation, lets a model draw on connected data sources when answering questions.

In an agent with network or database permissions, manipulated prompts can therefore become an attempt to misuse the agent’s access not merely to elicit text.

Most notably, the operator supplied Nightingale monitoring-system details and Redis key names associated with a real online-gambling environment, then requested targeted analysis in Chinese.

Sekoia reports that public internet-search data showed the exposed Nightingale interface, Redis service and corresponding keys.

The researchers assess that the attacker was seeking vulnerability and lateral-movementguidance for an iGaming target.

The prompts show an attempt to use an LLM as an offensive assistant; they do not, on their own, prove that the agent accessed the target or carried out an intrusion.

iGaming app and website targeted (Source : Sekoia).

Chinese-language prompts and gambling-sector terminology point to a likely fluent Chinese speaker familiar with offshore iGaming infrastructure.

Sekoia characterizes the activity as opportunistic cybercrime, not a confirmed operation by a named advanced persistent threat (APT) group.

It notes that victimology overlaps with campaigns targeting gambling businesses, but says the observed tradecraft is insufficient for precise attribution.

The central security issue is Flowise’s position in an organization’s architecture: it may hold model-provider keys, connect to private data stores and grant agents access to tools.

Those capabilities make an exposed or overprivileged instance a potential route to both credential exposure and data misuse.

Organizations should inventory exposed Flowise deployments, restrict access to administrative and credential APIs, update to versions that address applicable vulnerabilities, and avoid placing secrets in workflows accessible to untrusted users.

Agent tools and outbound network access should be limited to what each workflow needs; RAG permissions should enforce the same access boundaries as the underlying data.

Logging should capture workflow changes, credential access, unusual inference requests and unexpected outbound connections.

Prompt-injection testing is also essential, but it cannot replace access controls: an agent should not be able to retrieve or execute anything its user is not authorized to access.

Sekoia’s broader guidance similarly emphasizes treating agents as privileged applications, applying least privilege, and monitoring their use.

IOCs

IOCsDetails
hxxp://154.217.251[.]226:19999/flowise-hbCallback URL
System StatusMalicious chatflow name
tame-session-001Injected session ID
TAME-2026-SECRET-7F3AInjected access code

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.