software_project · DiggingBeagle record
Flowise
Flowise provides visual agent/workflow orchestration and integration APIs. The cited attack evidence is from a deception environment, not a breached production installation.
- Entity kind
- software_project
Record description
Flowise assembles LLM workflows and agents through a visual interface, exposing flow APIs and storing integration credentials. Sekoia emulated its API surface to study attacks on exposed orchestration services.
In the Sekoia exercise the exposed API was a deliberately simulated, unauthenticated 2.2.8 Flowise instance. Investigators observed enumeration, dummy-credential collection and attempted workflow abuse, but the emulator did not run models or execute system code. Those interactions are evidence of hostile intent at an orchestration API, not proof of a successful attack through a real Flowise agent. Study.
The synthetic environment separates attacker intent from agent outcome: it can record submitted workflow mutations or prompt payloads but cannot validate model compliance or command execution.
A separate October 29 Wiz investigation recorded an actually compromised Flowise host running adaptive script activity and probing additional instances. That real-host observation must not be retroactively attributed to the earlier Sekoia honeypot, which intentionally emulated Flowise and could not execute the claimed commands. The Wiz account measured attempted downstream activity but did not verify the number of compromised secondary hosts. Wiz investigation.
For the actual Wiz Flowise intrusion, the relevant exposed capability was a custom-function endpoint associated with an internal-request header, not the ordinary act of asking an LLM a question. The compromised host generated or executed approximately ninety-nine adaptive scripts in twenty-four hours and used its runtime to try additional network targets, including other Flowise services. The script count is an attempt volume and cannot be substituted for confirmed secondary victims. Wiz’s other GraphQL MCP command-argument and Java gateway cases concern different applications and initial sinks; connecting them as a single Flowise compromise would invent a shared implementation. Reconciliation should therefore keep Flowise as the affected workflow product and Wiz as investigator of the particular compromised host. Incident trace.