Hujumchilar Flowise AI agentlarini ma'lumot o'g'irlash, prompt in'ektsiyasi va ish oqimi egallash bilan nishonga olishdi

Hujumchi ochiq Flowise AI orkestratsiya serveridan foydalanib, ish oqimlarini ro'yxatga oldi, ma'lumotlarni o'g'irladi va til-model agentini hujumkor tahlil yordamchisiga aylantirishga urindi.

Sekoia ma'lumotlari birinchi marta 2026-yil 7-sentabrda shaxsiy FLINT hisobotida e'lon qilinganini aytadi.

Honeypot Flowise 2.2.8 ni taqlid qildi va haqiqiy tizim kodini yoki til modelini ishga tushirmasdan so'rovlarni ushlab qoldi. Hujumchi avval xizmat va versiyani tekshirdi, so'ngra chatflowlar va saqlangan ma'lumotlarni ro'yxatga oladigan API'larni so'radi.

Alohida ma'lumot yozuvlariga qilingan so'rovlar API kalitlari va ma'lumotlar bazasi ulanish tafsilotlarini qidirgan.

Xulq-atvor autentifikatsiyani chetlab o'tish kamchiligiga o'xshardi, ammo Sekoia bu faoliyat CVE-2024-31621 ekspluatatsiyasini ko'rsatmaganini aniq aytadi: bu muammo Flowise 1.6.6 da tuzatilgan va faqat xulq-atvor taqqoslash sifatida keltirilgan.

Taxminan ikki soatlik tanaffusdan so'ng, operator kengroq API'lar to'plamini tekshirish va inferens marshrutlarini sinash uchun qaytdi.

So'ngra ular mavjud ish oqimini qayta nomlashga va hujumchi infratuzilmasiga yo'naltirilgan HTTP Request tugunini o'z ichiga olgan yangi "System Status" chatflowini yaratishga urindilar.

Agar bajarilsa, oqim serverni tashqi qayta qo'ng'iroq yuborishga majbur qilishi mumkin edi. Bu qonuniy ish oqimi funksiyasidan suiiste'mol qilishga urinish edi — hujumchi kod bajarilishi yoki doimiy kirish huquqiga ega bo'lganini isbot emas.

Ketma-ketlik avtomatlashtirilgan yakun nuqtasi kashfiyoti bilan birga ko'proq moslashtirilgan promptlarni birlashtirdi, bu esa dastlabki skaner va keyin qo'lda o'zaro ta'sirni ko'rsatadi.

Honeypotning simulyatsiya qilingan javoblari va kanar ma'lumotlari tadqiqotchilarga urinishlarni kuzatishga yordam berdi; haqiqiy model yoki tizim kodini ishlatmagani uchun, tekshiruv maxfiy ma'lumotlar haqiqatan ham ishlab chiqarish Flowise joylashuvidan o'g'irlanganini aniqlamaydi.

Bir nechta ma'lum zaifliklarga qaratilgan ekspluatatsiya urinishlari, jumladan CustomMCP masofaviy kod bajarish zaifligi (CVE-2025-59528), CSV Agent masofaviy kod bajarish zaifligi (CVE-2026-41264) va CVE-2024-31621 ga o'xshash autentifikatsiyani chetlab o'tish va ma'lumot oshkor qilish kamchiliklari.

Flowise honeypot hujum xronologiyasi (Manba: Sekoia).

Sekoia tadqiqotchilari 2026-yil avgust oxirida honeypotga qarshi kuzatilgan faoliyat, modellarni maxfiy ma'lumotlar, ma'lumotlar bazalari va tashqi vositalar bilan bog'laydigan platformalar qanday qimmatli nishonlarga aylanishi mumkinligini ko'rsatishini kuzatdilar.

Hujumchi shuningdek, ko'rsatmalarni bekor qilish, tizim promptlari yoki suhbat tarixini ochish, mavjud vositalarni tekshirish va simulyatsiya qilingan moliya RAG ish oqimidan ma'lumot olish uchun mo'ljallangan promptlarni yubordi.

RAG, ya'ni retrieval-augmented generation, modelga javob berishda ulangan ma'lumot manbalaridan foydalanish imkonini beradi.

Tarmoq yoki ma'lumotlar bazasi ruxsatlariga ega agentda, manipulyatsiya qilingan promptlar shuning uchun agentning kirish huquqidan suiiste'mol qilishga urinish bo'lishi mumkin — faqat matn olish emas.

Eng e'tiborga molik jihat, operator haqiqiy onlayn-qimor muhitiga tegishli Nightingale monitoring tizimi tafsilotlari va Redis kalit nomlarini taqdim etdi, so'ngra xitoy tilida maqsadli tahlilni so'radi.

Sekoia jamoat internet-qidiruv ma'lumotlari ochiq Nightingale interfeysi, Redis xizmati va tegishli kalitlarni ko'rsatganini xabar qiladi.

Tadqiqotchilar hujumchi iGaming nishoni uchun zaiflik va yon harakat yo'riqnomasi izlayotganini baholaydilar.

Promptlar LLMni hujumkor yordamchi sifatida ishlatishga urinishni ko'rsatadi; ular o'z-o'zidan agent nishonga kirganini yoki kirishni amalga oshirganini isbotlamaydi.

iGaming ilovasi va veb-sayti nishonga olingan (Manba: Sekoia).

Xitoy tilidagi promptlar va qimor sektori terminologiyasi ehtimol offshore iGaming infratuzilmasi bilan tanish, xitoy tilida ravon gapiradigan shaxsni ko'rsatadi.

Sekoia bu faoliyatni tasodifiy kiberjinoyat sifatida tavsiflaydi, ma'lum ilg'or doimiy tahdid (APT) guruhi tomonidan tasdiqlangan operatsiya emas.

U qurbonologiya qimor bizneslarini nishonga olgan kampaniyalar bilan mos kelishini ta'kidlaydi, ammo kuzatilgan savdo uslubi aniq atributsiya uchun yetarli emasligini aytadi.

Asosiy xavfsizlik muammosi Flowise'ning tashkilot arxitekturasidagi o'rni: u model-provayder kalitlarini saqlashi, shaxsiy ma'lumot omborlariga ulanishi va agentlarga vositalarga kirish huquqini berishi mumkin.

Bu imkoniyatlar ochiq yoki ortiqcha huquqli misolni ma'lumot oshkor qilish va ma'lumot suiiste'moliga potentsial yo'lga aylantiradi.

Tashkilotlar ochiq Flowise joylashuvlarini ro'yxatga olishlari, ma'muriy va ma'lumot API'lariga kirishni cheklashlari, tegishli zaifliklarni tuzatuvchi versiyalarga yangilashlari va ishonchsiz foydalanuvchilarga kirish mumkin bo'lgan ish oqimlarida maxfiy ma'lumotlarni saqlamasliklari kerak.

Agent vositalari va tashqi tarmoq kirishi har bir ish oqimi uchun zarur bo'lgan narsalar bilan cheklanishi kerak; RAG ruxsatlari asosiy ma'lumot bilan bir xil kirish chegaralarini joriy etishi lozim.

Jurnallar ish oqimi o'zgarishlari, ma'lumot kirishi, g'ayrioddiy inferens so'rovlari va kutilmagan tashqi ulanishlarni yozib olishi kerak.

Prompt-in'ektsiya sinovi ham muhim, ammo u kirish nazoratini almashtira olmaydi: agent foydalanuvchisi ruxsat etilmagan hech narsani olish yoki bajarish imkoniga ega bo'lmasligi kerak.

Sekoia'ning kengroq yo'riqnomasi ham agentlarni imtiyozli ilovalar sifatida ko'rish, eng kam huquqni qo'llash va ulardan foydalanishni kuzatishni ta'kidlaydi.

IOC'lar

Eslatma: IP manzillar va domenlar tasodifiy hal qilinish yoki giperhavola qilishning oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat nazorat qilinadigan tahdid razvedka platformalarida, masalan MISP, VirusTotal yoki SIEM'da qayta fang qiling.

An attacker used an exposed Flowise AI orchestration server to enumerate workflows, harvest credentials, and try to turn its language-model agent into an offensive analysis assistant.

Sekoia says the findings were first shared in a private FLINT report on 7 September 2026.

The honeypot emulated Flowise 2.2.8 and captured requests without running real system code or a language model. The attacker first checked the service and version, then queried APIs listing chatflows and stored credentials.

Requests to individual credential records sought API keys and database connection details.

The behavior resembled an authentication-bypass flaw, but Sekoia explicitly says the activity did not demonstrate exploitation of CVE-2024-31621: that issue was fixed in Flowise 1.6.6 and was cited only as a behavior comparison.

After a roughly two-hour pause, the operator returned to probe a wider range of APIs and test inference routes.

They then tried to rename an existing workflow and create a new “System Status” chatflow containing an HTTP Request node pointed at attacker infrastructure.

If executed, the flow could make the server send an outbound callback. This was an attempt to abuse legitimate workflow functionality not proof that the attacker achieved code execution or persistence.

The sequence combined automated endpoint discovery with more tailored prompts, suggesting an initial scanner followed by hands-on interaction.

The honeypot’s simulated responses and canary credentials helped researchers observe the attempts; because it did not run a real model or system code, the investigation does not establish that secrets were actually stolen from a production Flowise deployment.

Exploitation attempts targeting several known vulnerabilities, including the CustomMCP remote code execution vulnerability (CVE-2025-59528), the CSV Agent remote code execution vulnerability (CVE-2026-41264), and authentication bypass and credential disclosure flaws similar to CVE-2024-31621.

Flowise honeypot attack timeline (Source : Sekoia).

Sekoia Researchers observed that, the activity, observed against a honeypot in late August 2026, illustrates how platforms that connect models to secrets, databases and external tools can become valuable targets.

The attacker also sent prompts designed to override instructions, expose system prompts or conversation history, probe available tools and retrieve information from a simulated finance RAG workflow.

RAG, or retrieval-augmented generation, lets a model draw on connected data sources when answering questions.

In an agent with network or database permissions, manipulated prompts can therefore become an attempt to misuse the agent’s access not merely to elicit text.

Most notably, the operator supplied Nightingale monitoring-system details and Redis key names associated with a real online-gambling environment, then requested targeted analysis in Chinese.

Sekoia reports that public internet-search data showed the exposed Nightingale interface, Redis service and corresponding keys.

The researchers assess that the attacker was seeking vulnerability and lateral-movementguidance for an iGaming target.

The prompts show an attempt to use an LLM as an offensive assistant; they do not, on their own, prove that the agent accessed the target or carried out an intrusion.

iGaming app and website targeted (Source : Sekoia).

Chinese-language prompts and gambling-sector terminology point to a likely fluent Chinese speaker familiar with offshore iGaming infrastructure.

Sekoia characterizes the activity as opportunistic cybercrime, not a confirmed operation by a named advanced persistent threat (APT) group.

It notes that victimology overlaps with campaigns targeting gambling businesses, but says the observed tradecraft is insufficient for precise attribution.

The central security issue is Flowise’s position in an organization’s architecture: it may hold model-provider keys, connect to private data stores and grant agents access to tools.

Those capabilities make an exposed or overprivileged instance a potential route to both credential exposure and data misuse.

Organizations should inventory exposed Flowise deployments, restrict access to administrative and credential APIs, update to versions that address applicable vulnerabilities, and avoid placing secrets in workflows accessible to untrusted users.

Agent tools and outbound network access should be limited to what each workflow needs; RAG permissions should enforce the same access boundaries as the underlying data.

Logging should capture workflow changes, credential access, unusual inference requests and unexpected outbound connections.

Prompt-injection testing is also essential, but it cannot replace access controls: an agent should not be able to retrieve or execute anything its user is not authorized to access.

Sekoia’s broader guidance similarly emphasizes treating agents as privileged applications, applying least privilege, and monitoring their use.

IOCs

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.