The report
Wiz documented a compromised Flowise instance used as a staging point for further intrusion attempts. The investigation recovered ninety-nine scripts over roughly twenty-four hours, including variations that examined other Flowise services and tried Node.js debugging or process-instrumentation paths. A compromised AI orchestration server became an attacker-controlled launcher, rather than simply a chatbot that returned an unsafe answer.
The record distinguishes an initial foothold from later attempts. Repeated probes against port 3000 and the appearance of dozens of target addresses do not prove that those machines were compromised. Wiz infers an AI-assisted adaptive workflow from the speed and structure of the scripts; the logs alone do not identify the model behind every generated command. The Wiz investigation includes two other intrusion narratives, but shared publication is not evidence that all three were the same incident or actor.
The Flowise Case identifies the exposed tool and process execution path. A useful response correlates Flowise custom-function calls with container shell activity and outbound probes, then tests whether the same principal can start processes from a public endpoint. That checks a concrete trust boundary without treating an attacker's script count as proof of downstream victim totals.