Flowise Honeypot Captures AI-Agent Abuse Targeting Online Gambling Infrastructure

Oct 19, 2026 · Original article ↗

Summary

Sekoia’s simulated Flowise honeypot recorded credential harvesting, workflow manipulation and prompts seeking offensive analysis of an online-gambling target. Researchers linked supplied Redis keys to exposed infrastructure but could not attribute the operator.

Key points

Sekoia’s Flowise 2.2.8 honeypot emulated API routes without running system code or a real language model, using canary credentials and simulated responses.
The attacker enumerated API endpoints and retrieved simulated secrets; researchers said the observed activity mainly abused legitimate Flowise features rather than exploiting the listed vulnerabilities.
The attacker tried to create a chatflow that would send an outbound HTTP callback to 154.217.251[.]226:19999.
Prompts attempted to access simulated financial data through a RAG-connected chatflow and use the agent for reconnaissance and tailored exploitation advice.
The attacker supplied Nightingale and Redis details; researchers found the same Redis keys in an exposed server and assessed it as belonging to the targeted iGaming infrastructure.
Prompts and target selection suggested a Chinese-speaking, opportunistic cybercriminal focused on Hong Kong and Taiwan infrastructure; the evidence did not support attribution to a known group.
Sekoia recommends strong authentication, strict permissions, outbound-network monitoring, and controls against prompt injection and agent abuse.

Article Details

Attack Vectors: The attacker enumerated the exposed Flowise REST API, including routes for version information, chatflows, credentials, and other data sources.
Unauthenticated requests to credential routes retrieved simulated API-key and database-credential details; the article says this behavior resembled CVE-2024-31621 but that vulnerability did not affect the honeypot version.
The attacker attempted to rename an existing chatflow and create a chatflow containing an HTTP Request node configured to contact attacker infrastructure.
Prompt-injection and jailbreak attempts sought to make the LLM query RAG-connected financial data, execute reconnaissance commands, and provide tailored attack guidance about a real Nightingale and Redis target.
The attacker periodically requested inventories of global variables and chatflows.
Defensive Notes: Use strong authentication for Flowise and restrict access to its API and administration routes.
Apply strict permission boundaries to AI agents, tools, credentials, and access to RAG-connected data.
Monitor and control outbound network connections from orchestration platforms.
Use controls against prompt injection and agent abuse, and alert on attempts to access or use sensitive credentials.

Indicators of compromise

Type	Indicator	Context
IPV4	`154[.]217[.]251[.]226`	Reported attacker source IP, also used as the callback address for the attempted chatflow.
URL	`hxxp[:]//154[.]217[.]251[.]226:19999/flowise-hb`	Attacker-configured callback URL in an attempted malicious Flowise chatflow.