Opportunistic attacker probes Flowise honeypot for credentials, hijacks workflows and uses LLM prompts for iGaming recon
Sekoia observed an attacker interacting with an exposed Flowise AI orchestration honeypot (emulating version 2.2.8) in late August 2026. The operator enumerated chatflows and stored credentials, tried to create a rogue workflow, and used prompt injection to turn the agent into an offensive analysis assistant. Sekoia assesses the activity …