Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Attacker Tries to Weaponize an Exposed Flowise AI Agent Against Other Servers

An unauthenticated Flowise honeypot showed an operator looting stored credentials, planting an outbound callback flow and using prompt injection to turn the AI agent into a recon assistant against real targets.

4T4Tify Team4Tify
Oct 22, 2026·5 min read
Attacker Tries to Weaponize an Exposed Flowise AI Agent Against Other Servers

Attacker Tries to Weaponize an Exposed AI Agent Platform Against Other Servers

An internet-facing AI workflow builder is not just a chat window. When it holds API keys, database connections and outbound HTTP tools, it becomes a foothold, and attackers are already treating it that way.

What happened

In late August 2026, Sekoia's Threat Detection & Research (TDR) team ran a decoy Flowise instance. Flowise is a popular open-source platform for building LLM workflows and agents. The decoy was left without authentication and was built to record activity, not to run a real model or real system commands. An operator found it and spent hours working through it:

  • Recon and credential grab (~3 minutes). The operator checked that the service was up, pulled the version and node settings, then listed the chatflows and stored credentials and asked for the details of specific ones. On a real, poorly protected install, those steps would expose AI provider keys and database secrets.
  • API sweep. After roughly two hours of silence, a broader scan of the API routes followed.
  • Workflow tampering. The attacker renamed an existing flow and created a new one called "System Status" containing an HTTP Request node pointed at external infrastructure. Run on a live server, that flow would make the Flowise host call out to attacker-controlled systems. Sekoia frames this as abuse of a legitimate feature, not exploitation of a software bug.
  • Prompt injection. Prompts tried to make the agent reveal its system instructions, call tools, run commands, recall a planted access code and leak other users' conversations. Posing as an "authorized auditor", the operator asked it to query a database and summarize records from a simulated finance chatflow.
  • Turning the agent outward. Finally the prompts targeted real infrastructure: a Nightingale monitoring server, Redis data, and an online gambling platform active in parts of Asia. The operator asked the AI for target analysis, likely weaknesses and access paths. Periodic polling of the decoy continued for about 16 hours.

The activity resembled unauthenticated access patterns linked to CVE-2024-31621 (fixed in Flowise 1.6.6), but that flaw was not exploited here. The researchers assess that the operator was likely Chinese-speaking with an interest in the iGaming sector, but say the evidence is too thin to tie the activity to a known group. Because this was a honeypot, everything above was an attempt; no real records or systems were reached.

Why it matters

The danger isn't that a chatbot can answer questions. It's that an agent can act: call tools, make network requests and read whatever data it is wired to. A prompt alone should never grant access. But an exposed admin interface, broad permissions, stored secrets and unrestricted egress together turn an AI builder into a credential vault and an attack relay that someone else controls.

What to do

  1. Never expose Flowise (or similar builders) unauthenticated. Put the admin UI and API behind SSO/VPN or an IP allow-list, and patch to a current release.
  2. Lock down who can edit flows. Workflow changes are effectively code changes, so review and alert on new or renamed flows.
  3. Store only the credentials each agent needs, scoped to least privilege, and rotate anything that may have been exposed.
  4. Restrict outbound traffic from agent hosts to the endpoints they actually need.
  5. Monitor the workflow and credential APIs for listing and enumeration bursts, and watch for prompt-injection patterns.
  6. Require human approval before an agent takes any action with real-world impact.
  7. Hunt for these indicators: callback hxxp://154.217.251[.]226:19999/flowise-hb, chatflow name System Status, session ID tame-session-001, access code TAME-2026-SECRET-7F3A.

Forgotten AI tooling is fast becoming the newest unmanaged edge of the perimeter. Our Attack Surface Management service continuously discovers internet-facing hosts and services like these, so an open AI builder gets flagged before someone else finds it.

Research credit: Sekoia Threat Detection & Research (TDR), via Cyber Security News.

SHARE