Observed incident
Flowise honeypots capture commands concealed in ordinary chat requests
Reported
Published here
What happened
Era recorded 4,972 identical greetings across seven Flowise honeypots. Per-request JavaScript overrides hid changing commands from stored chat history. The commands enumerated hosts and retrieved planted cloud credentials.
Parties and reporting
AI tools and systems: Flowise Prediction API, Custom JavaScript Function, Greeter (researcher label)
Outcome
Attacks reached the instrumented systems. Era observed credential searches and tests for staging an in-memory payload. It did not establish execution of that payload or compromise of a production customer.
Operating lesson
Authenticate prediction endpoints, disallow untrusted executable overrides and review request bodies alongside workflow history. Restrict what credentials the workload can reach.
Evidence and limits
Era observed traffic July–October and attributes the mechanism to CVE-2024-58351. The original flaw was publicly documented in 2024. Chinese-language markers and command timing do not identify an operator or prove attacker AI use. The seven research deployments are distinct from Sekoia’s Flowise honeypot.
Sources
- Era original GREETER honeypot analysis
Primary source ·
- Original disclosure of CVE-2024-58351 (Flowise overrideConfig advisory)
Primary source ·