Attacker probes Sekoia’s decoy Flowise agent

What happened

Sekoia observed an attacker retrieving planted credentials from a decoy Flowise service and submitting requests intended to turn its agent into a reconnaissance assistant.

The activity was observed in late August, shared privately on 7 September and published on 19 October. The controlled service used canary credentials and simulated generation. The evidence demonstrates attempts to misuse an exposed orchestration service. Sekoia describes API enumeration, attempted workflow changes and prompts about gambling-related infrastructure.