Every message looked like a chatbot user saying “hello.” Behind them, researchers at security firm Era found a Chinese-language exploitation framework it named Greeter, targeting exposed servers running Flowise, a popular open-source platform for building AI agents and chatbots.
In research published Nov. 3, Era said Greeter exploited CVE-2024-58351, an old but critical Flowise flaw, to run commands without changing the saved chatflow, so the workflow itself looked harmless.
Era recorded the activity from July to October on seven Flowise honeypots, decoy servers it had deliberately left without authentication, across four regions.
All 4,972 stored user messages were the same “hello,” while the chatbot’s replies held the results of attack commands, including user identities, cloud credentials, metadata probes and network information.
The commands arrived 3.5 seconds apart. Era said the cadence suggested automated execution, potentially involving an AI agent, but that timing alone could not establish it.
Greeter Profiled Hosts and Searched for Cloud Access
Era reconstructed the attack from more than 4,000 commands. Greeter profiled the host, checked whether it could reach Docker’s controls, collected environment variables and probed AWS, Azure and Google Cloud metadata services.
It also searched for configuration files, SSH keys, database files and Flowise’s own encryption key. Its attempt to establish persistence failed.
The honeypots returned fake credentials, so Era did not see a real cloud account accessed. On a production deployment, Era said, the same access could hand an attacker credentials and workload identities, depending on the application’s permissions.
Stolen cloud and AI credentials of this kind are what fuel attacks in which criminals hijack and resell enterprise AI access.
Era found 4,372 Flowise instances exposed to the internet through Shodan. Of the 3,277 that reported a version, 703 had no authentication, and 46 appeared to share the vulnerable conditions recreated in the honeypots.
Era estimated that far more were exposed to newer flaws: 89.2% to a sandbox escape, CVE-2026-46442, and 99.3% to a code-injection flaw, CVE-2026-69255. It stressed that these were version-based estimates, not confirmed compromises.
Era Recommends Restricting the Application’s Reach
Era recommended updating Flowise, requiring authentication on its APIs and restricting access to Docker’s controls.
It also advised running the application as a non-root user without sudo, removing unnecessary container privileges and giving each workload its own narrowly scoped cloud identity.
It advised against keeping long-lived credentials in files or environment variables when a suitable workload identity is available, and recommended tightly restricting permissions that let cloud roles be changed or assumed. Teams should also monitor the cloud identity’s activity alongside the host, it said.
Era recommended requiring IMDSv2 on AWS, while cautioning that this does not contain an attacker who can already run code on the server and request a metadata token.
The company’s central advice was to secure “not just the AI applications you deploy, but everything those applications have permission to access.”
