Attacker Attempts to Weaponize Open-Source AI Platform Flowise for Reconnaissance
An attacker was observed attempting to misuse an exposed Flowise honeypot, probing for credentials and trying to create workflows to contact external infrastructure, indicating a growing trend of weaponizing AI tools.
An investigation into an exposed Flowise honeypot has revealed an attacker's attempts to leverage the open-source AI workflow platform for malicious purposes. The intruder actively queried chatflows and credentials, and attempted to construct a workflow designed to communicate with attacker-controlled infrastructure. This incident highlights a concerning trend where attackers are seeking to weaponize AI platforms, turning them into tools for reconnaissance and potentially further exploitation.
The honeypot, set up by Sekoia's Threat Detection & Research team, was designed to record activity without executing real system commands or running a live language model. The attacker's initial actions, occurring in late August 2026, involved unauthenticated requests to inspect the service, list its workflows, and retrieve stored credentials. These early steps, lasting approximately three minutes, were followed by a more extensive scan of API routes after a two-hour pause. While the behavior bore some resemblance to unauthenticated access associated with CVE-2024-31621, Sekoia noted that this specific flaw was not exploited in the honeypot, though it was fixed in Flowise 1.6.6.
Following basic inference requests, the attacker attempted to rename an existing workflow and create a new one titled "System Status." This new workflow incorporated an HTTP Request node configured to target an external server. In a live environment, such a workflow could enable the compromised Flowise server to establish contact with infrastructure controlled by the attacker, representing a misuse of legitimate outbound request features rather than a direct software exploit.
The attacker also employed prompt injection techniques, sending crafted prompts to probe the AI agent's capabilities. These prompts aimed to reveal system instructions, encourage the use of tools, execute commands, recall planted access codes, and disclose conversations from other users. These efforts were designed to push the AI system beyond its intended role and bypass its safeguards, with a particular focus on data related to a simulated finance chatflow.
During these prompt injection attempts, the attacker posed as conducting an authorized audit, requesting the agent to query a database and summarize financial records. The prompts later shifted to focus on reconnaissance against a simulated internal host. Although the honeypot did not execute system commands or run a real model, the evidence clearly shows the attacker's intent and methods.
The activity then escalated to target what appeared to be a real-world infrastructure, with prompts referencing a Nightingale monitoring server, Redis data, and an online gambling platform operating in Asia. The attacker sought target analysis and guidance on potential weaknesses and access paths, suggesting a sophisticated interest in the online gambling sector. Sekoia assessed that the activity pointed to a Chinese-speaking operator but lacked sufficient evidence to attribute it to a known threat group.
This incident underscores the broader concern surrounding AI agents that integrate natural-language prompts with access to tools, databases, or cloud permissions. The primary risk lies not just in the chatbot's ability to answer questions, but in its potential to act upon those answers by invoking tools, making network requests, or accessing connected data. Weak authentication, broad permissions, and unrestricted network paths can significantly amplify the impact of prompt injection attacks.
Organizations utilizing Flowise or similar platforms are strongly advised to implement robust security measures. These include restricting administrative interfaces to authorized users and networks, carefully reviewing workflow access and modification permissions, and adhering to the principle of least privilege for stored credentials. Limiting outbound connections, monitoring for unusual API requests, and requiring human approval for sensitive actions are also critical steps to mitigate the risks associated with AI agent misuse.