Sekoia honeypot: an attacker turned an exposed Flowise agent into a recon tool
Sekoia's Flowise honeypot shows an attacker treating an exposed AI agent platform as both a credential store and an offensive assistant.
· Sekoia · Research by Jérémy Scion, Sekoia TDR Team
.webp)
An attacker found Sekoia's unauthenticated Flowise honeypot, took the stored OpenAI, Anthropic and Postgres credentials, then used the agent itself to plan attacks on a gambling network, Sekoia's threat research team reports.
01What happened
Sekoia's Threat Detection and Research team ran a honeypot that emulated Flowise, an open-source visual builder for LLM agents. An actor found the unauthenticated instance in late August 2026 and worked through six phases, from a three-minute burst of fingerprinting and credential theft to polling the instance every 10 minutes. Jérémy Scion and the TDR team published the analysis on October 19, 2026, after first sending it to customers as a private report on September 7, 2026.
02How it works
No software flaw was exploited. The instance asked for no authentication, so the actor called Flowise's own REST API to enumerate chatflows and read stored credentials, then built a chatflow holding an HTTP Request node that made the server call back to attacker infrastructure. Sekoia classes that callback as abuse of a legitimate outbound-request feature rather than server-side request forgery. Against the agent itself the actor tried system prompt extraction, multi-turn memory poisoning with a planted access code, and a system message override, and fed it real reconnaissance data to generate exploitation playbooks.
03Who is affected
Any internet-facing Flowise instance that runs without authentication is exposed, and so is everything the platform holds. Sekoia warns that protecting API keys alone is not enough, because a platform wired into a retrieval pipeline also exposes the data behind it.
04What to do
Require strong authentication and strict permission boundaries on any Flowise or comparable agent builder, monitor its outbound connections, and give each agent only the credentials it needs. Instances on flowise 3.0.13 or earlier should also move to 3.1.0, which fixes the critical CSV Agent prompt-injection code execution flaw listed below.
Questions people ask
- Was a Flowise vulnerability exploited in the Sekoia honeypot attack?
- Sekoia reports no software exploitation. The honeypot asked for no authentication, so the actor used Flowise's own REST API and node types to read credentials and create a callback chatflow. Sekoia notes the behaviour resembles CVE-2024-31621 but says that flaw was fixed in Flowise 1.6.6 and does not affect the emulated version, so it is cited only to describe what was observed.
- How can I tell whether my Flowise instance was probed the same way?
- Sekoia publishes indicators defenders can search for: a chatflow named System Status, outbound requests to the callback address listed above, an injected session ID of tame-session-001, and a planted access code of TAME-2026-SECRET-7F3A. Reviewing access logs for enumeration of the chatflows and credentials API endpoints is the other practical check.
- Who was behind the Flowise honeypot activity?
- Sekoia assesses with high confidence that the operator is a fluent, likely native Chinese speaker familiar with gambling slang, acting for opportunistic cybercrime rather than as a bespoke state actor. Sekoia does not attribute the activity to a named group, though it notes sector overlap with Earth Berberoka and Operation Dragon Castling. The targets named were a Nightingale monitoring server and an iGaming cluster.
Sources 2 links, all fetched
- 1sekoia.comSekoia Analysis
- 2github.comFlowise CSV Agent RCE