What happened
Sekoia's Threat Detection & Research team operated a Flowise 2.2.8 honeypot emulating the GenAI orchestration attack surface. In late August 2026 an unauthenticated instance was subjected to reconnaissance and attack: the actor probed /chatflows and /credentials, attempted credential harvesting of planted canary LLM/OAuth/database tokens, attempted workflow changes and jailbreaks, and tried to repurpose the LLM agent as an offensive analysis vector against external targets (Nightingale monitoring and unregulated gambling infrastructure). The attacker is assessed as likely Chinese-speaking and cybercriminal-motivated (published 2026-10-19).
Why it matters
Flowise concentrates API keys, enterprise RAG data and outbound tool access, and has multiple unauth-RCE/auth-bypass vulnerabilities; this is direct evidence of real-world automated exploitation attempts against AI orchestration platforms — credential harvesting and LLM/agent hijacking — rather than just a theoretical concern. It reinforces that unauth AI-orchestration endpoints are actively being probed and driven.
Attack vector
Unauthenticated probing of Flowise REST routes, credential-harvesting of planted API/OAuth/DB tokens, workflow manipulation and jailbreak attempts against an agent
Affected systems
Flowise (2.2.8 emulation) and similar unauthenticated GenAI orchestration/agent platforms
Mitigation
Authenticate orchestration interfaces, limit stored credentials and tool permissions, monitor for unexpected workflow changes and outbound requests from the agent platform