An attacker who broke into what they thought was a company's AI server did not stop at stealing its passwords. They told the AI agent running on it to forget its job and help them plan an attack on a real online gambling network, and asked for the answer in Chinese.
The server was a decoy. Sekoia's Threat Detection and Research (TDR) team runs honeypots worldwide, and this one, hosted in Japan, imitated an unauthenticated install of Flowise, a popular open-source tool for building chatbots and AI agents. Sekoia published the account in the original report, first sent privately to its customers on 7 September 2026. The intrusion took place in late August.
Why AI orchestration servers are worth robbing
Platforms like Flowise sit in the middle of an organization's AI setup. They store model API keys and database credentials, and often connect agents to private company data through retrieval-augmented generation (RAG). One exposed instance can hand over secrets and a path to the data behind them. We previously covered a poisoned-CSV flaw that let attackers hijack Flowise servers, and attackers pulling AI proxy keys out of memory.
Sekoia's decoy watched for exploitation of known Flowise remote code execution flaws, including CVE-2025-59528 in the CustomMCP node and CVE-2026-41264 in the CSV Agent. This attacker did not need them. They abused features the exposed instance already offered.
From a scan to a human at the keyboard
The attack opened with about three minutes of automated reconnaissance. The tool checked the server's version, listed its chatflows and pulled every saved credential (canary tokens, in the honeypot). After a two-hour pause it returned, swept more than a dozen API areas and sent the AI a simple "hi". Sekoia reads the pattern as a scanner followed by a human operator.
The operator tried to rename an existing chatflow and to create a new one called "System Status" containing an HTTP request node pointed at attacker infrastructure. Sekoia says the flow, once run, would make the victim server call out to the attacker, giving a heartbeat and an exfiltration channel. Requests polling the server's variables and chatflows then repeated every 10 minutes.
Next came a familiar run of attacks on the model itself: probing its tools, telling it to run the "id" command, demanding its system prompt and requesting other users' conversations. Once the attacker noticed a finance chatflow tied to a database, the prompts became tailored, posing as an "authorized audit" and asking the agent to list every financial record it could reach.
The AI agent as an attack planner
The operator then turned the agent outward. One prompt supplied the address and Redis keys of a real Nightingale monitoring server, a Chinese tool similar to Grafana, and asked which business it served and where to move next. A follow-up in Chinese asked for known unauthorized-access flaws, default credentials and API exploitation paths, noting the target had CAPTCHA disabled and root login enabled.
Sekoia confirmed through Shodan that the server exists and exposes the exact keys quoted. The team assesses with high confidence that it belongs to an unregulated online casino network operating across Asia and Brazil, and that the attacker is a fluent, likely native, Chinese speaker. One prompt used 菠菜 ("spinach"), cybercrime slang for gambling. Sekoia does not attribute the activity to a known group, and says the shared focus on gambling with groups such as Earth Berberoka is sector context, not a link.
Lock Flowise down and watch what leaves it
Sekoia's advice is that guarding API keys is not enough. Never expose Flowise without authentication, keep it patched against the CVEs above, set strict permission boundaries on what agents can reach, monitor outbound traffic from AI hosts, and add controls against prompt injection.
Indicators shared by Sekoia:
- Source and callback IP: 154[.]217[.]251[.]226
- Callback URL: hxxp://154[.]217[.]251[.]226:19999/flowise-hb
- Rogue chatflow name: "System Status"
The striking part is not the credential theft, which any scanner can do. It is that an attacker treated someone else's AI agent as a free research assistant for their next intrusion, and anyone running an open AI server could be lending theirs out the same way.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.