A Hacker Tried to Turn an AI Chatbot Into a Tool for Attacking Other Servers

An exposed artificial intelligence platform can give an intruder more than a place to send messages. If it connects to stored credentials, company data, or network tools, the platform may also provide a route toward those resources.

A recent honeypot investigation shows how an attacker tried to use an AI agent to study real infrastructure and prepare further activity.

The incident involved Flowise, an open-source platform for building AI workflows. In late August 2026, an unauthenticated Flowise honeypot received requests to inspect the service, list its workflows, and retrieve stored credentials.

The honeypot was a decoy, not a live production system; it was designed to record activity without running real system commands or a real language model.

Analysts from Sekoia’s Threat Detection & Research team identified the activity and documented how the intruder moved from basic checks to attempts to misuse the AI agent.

Their report describes an operator who tried to obtain sensitive data and turn the chatbot into an assistant for examining other servers. The Sekoia investigation says the activity mainly abused Flowise features rather than relying on a software flaw.

A Hacker Tried to Turn an AI Chatbot Into a Tool

The attacker first checked whether the Flowise service was available and queried its version and node settings. They then requested lists of chatflows and credentials, followed by requests for details tied to specific credentials.

Those steps could reveal AI service keys and database access details on a poorly protected real installation. The early activity lasted about three minutes, then stopped for just over two hours before a wider scan of the API routes.

The report notes that the behavior resembled unauthenticated access associated with CVE-2024-31621, but says that particular flaw was not exploited in the honeypot.

It was fixed in Flowise 1.6.6 and was included in the report only to describe the observed pattern. Separately, the Flowise vulnerability report covers risks tied to exposed Flowise installations and sensitive credentials.

After testing basic inference requests, the operator tried to rename an existing workflow and create a new one called “System Status.” The new workflow included an HTTP Request node aimed at an external server.

If a similar workflow were executed in a live environment, it could make the Flowise server contact attacker-controlled infrastructure. Sekoia described this as misuse of a legitimate outbound request feature, rather than a confirmed software exploit.

Prompts aimed at the AI agent

The attacker also sent prompts designed to probe the agent’s capabilities. They asked it to reveal its system instructions, use tools, run commands, recall a planted access code, and disclose conversations from other users.

These attempts are examples of prompt injection: instructions crafted to push an AI system away from its intended role or safeguards.

The prompts also tried to reach data connected to a simulated finance chatflow. The attacker claimed to be conducting an authorized audit and asked the agent to query a database and summarize financial records.

Sekoia says the operator later tried to get the agent to perform reconnaissance against a simulated internal host. Because the honeypot did not run a real model or execute system commands, the evidence shows attempts—not successful access to real records or systems.

The activity then shifted toward a real target. The prompts included details about a Nightingale monitoring server, Redis data, and an online gambling platform operating across parts of Asia.

The attacker asked for target analysis and guidance on weaknesses and access paths. Sekoia assessed that the information suggested a Chinese-speaking operator and an interest in the online gambling sector, but said there was not enough evidence to link the activity to a known group.

This case is part of a wider concern about agents that combine natural-language prompts with tools, databases, or cloud permissions. A separate report on AI agents and cloud credentials describes how prompt injection can become more serious when an agent can reach services or secrets.

Research on AI agent traps also examines how untrusted content can affect an agent’s decisions and memory. The key risk is not that a chatbot can answer questions.

It is that an agent may be able to act on its answers by calling tools, making network requests, or reading connected data. A prompt alone should not grant access, but weak authentication, broad permissions, and unrestricted network paths can give an attacker more room to work.

Organizations using Flowise or similar platforms should restrict administrative interfaces to authorized users and networks, review who can read or change workflows, and store only the credentials each agent needs.

Teams should also limit outbound connections, monitor unusual requests to workflow and credential APIs, and require human approval before an agent takes actions with sensitive impact. Sekoia recommends strong authentication, strict permission boundaries, and monitoring for prompt injection and misuse of agent capabilities.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post A Hacker Tried to Turn an AI Chatbot Into a Tool for Attacking Other Servers appeared first on Cyber Security News.