Hacker attempts prompt injection on Flowise AI agent
Original title: A Hacker Tried to Turn an AI Chatbot Into a Tool for Attacking Other Servers
Exposed Flowise honeypot shows attacker using AI agent for reconnaissance against other servers via prompt injection.
A Flowise honeypot received requests to list workflows and credentials in late August 2026. The attacker attempted to rename workflows and create one for HTTP requests to external servers. Prompts were sent to probe agent capabilities and conduct reconnaissance on simulated targets.
Unconfirmed: No confirmed exploitation of real systems
- Early activity lasted three minutes then paused.
- Attacker requested credential lists and details.
- New workflow named System Status with HTTP node.
- Prompts tested system instructions and tool use.
- Targeted simulated iGaming platform in Asia.
Impact: Prompt injection to misuse AI agent for reconnaissance
- 1.Restrict administrative interfaces
- 2.Monitor unusual workflow requests
- 3.Require human approval for agent actions
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-31621 | An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component | 7.6 | 60% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 154.217.251.226 | promise (IoCs):- Type Indicator Context Callback URL hxxp://154.217.251[.]226:19999/flowise-hb URL included in the attempted “System St |
| url | http://154.217.251.226:19999/flowise-hb | of compromise (IoCs):- Type Indicator Context Callback URL hxxp://154.217.251[.]226:19999/flowise-hb URL included in the attempted “System Status” workflow Ch |
From the original article
4 min read at cybersecuritynews.com
An exposed artificial intelligence platform can give an intruder more than a place to send messages. If it connects to stored credentials, company data, or network tools, the platform may also provide a route toward those resources. A recent honeypot investigation shows how an attacker tried to use an AI agent to study real infrastructure […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.