An attacker harvested decoy Flowise secrets and submitted offensive agent prompts

CLM-SEKOIA-FLOWISE-HONEYPOT-1 reports: The honeypot simulated Flowise 2.2.8 without executing real model inference or system code. Its attacker prompts therefore establish attempted misuse, not a successful LLM-led intrusion. Source SRC-2026-CP17-SEKOIA-FLOWISE is located at 'Context and perimeter: Sekoia Honeypot overview'. The distinctive mechanism begins: Sekoia emulated the Flowise 2.2.8 REST surface in a deception service, with decoy credentials and synthetic chatflows but no live model execution or operating-system shell. Classification: setting=controlled_live, exploit_status=observed_live, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=unknown; scoped control or limit: Protect chatflow and credential APIs through authentication and authorization, constrain outbound workflow destinations and treat the textual request to the model as untrusted. The honeypot was designed to answer probes, so its apparent responses cannot be read as production exploitation results. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.

Assessed Oct 23, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-SEKOIA-FLOWISE-HONEYPOT-1 · CLM-SEKOIA-FLOWISE-HONEYPOT-2 · Sekoia: An attack against a simulated Flowise service