Greeter exploit framework hides cloud theft on AI servers

Security researchers are tracking a stealthy new exploitation campaign that uses an ephemeral, log-evading injection technique to turn exposed AI orchestration infrastructure into entry points for cloud account takeover.

Researchers at Era Security discovered the attack and dubbed it Greeter . The Chinese-language framework targets legacy, unpatched deployments of Flowise, the widely adopted open source AI agent platform that reached official end-of-life in August 2026.

Rather than modifying stored workflows or leaving traces in chat logs, Greeter delivers malicious payloads per-request through API overrides. The result is a benign-looking audit trail of repetitive “hello” messages that masks active host reconnaissance, credential harvesting and cloud metadata probing.

The total number of actively vulnerable deployments remains relatively small, but security experts warned that the campaign exposes a critical structural blind spot in modern AI infrastructure. By abusing per-request API overrides, Greeter introduces a novel stealth mechanism that evades standard workflow audits: it turns exposed AI workloads into quiet, log-invisible entry points for cloud credential theft and host takeover.

At the core of the attack chain is CVE-2024-58351 , a two-year-old runtime configuration flaw in Flowise versions before version 2.1.4. The vulnerability allows remote attackers to supply a javascriptFunction key inside the overrideConfig request parameter.

When invoked, the framework replaces the code of Custom JavaScript Function nodes on the fly. Because the payload is injected per-request, the stored chatflow definition in the database remains completely untampered.

In logs and chat histories, all 4,972 recorded user messages in the researchers’ honeypots simply read “hello” — sent in steady 3.5-second intervals. Behind those surface-level greetings, however, the server returned complete environment profiles, process listings, host configurations and stolen credentials.

“The central finding … is the AI-powered attack framework, and the speed and precision with which it exploits and investigates a compromised host,” Neta Roza, founder and CEO of Era Security, told TechTarget Cybersecurity . “The attack instructions were supplied through overrideConfig.javascriptFunction, while stored user messages contained only re‘hello.’ The malicious function could change with each request without altering the saved chatflow, leaving an incomplete picture for defenders inspecting workflow definitions or chat history alone.”

From exposed workload to enterprise cloud pivot

While Greeter’s immediate target is the Flowise host, its long-term objective is pivoting deeper into the host's associated cloud accounts. By querying instance metadata services (IMDS), Era Security said attackers could attempt to extract temporary AWS Identity and Access Management (IAM) or Google Cloud service account tokens assigned to the underlying virtual machine or container.

While Era didn't observe successful cross-account takeover in their honeypots, Roza notes that this vector mirrors real-world enterprise intrusions, such as the 2023 ScarletEel 2.0 campaign documented by Sysdig, where attackers used compromised container workloads and IMDS tokens to gain admin rights and launch unauthorized compute instances.

“Stealing an instance role’s credentials gives the attacker that role’s existing permissions; it does not automatically grant administrative access,” Roza explained. “Applicable IAM policies and organizational controls determine how far the attacker can proceed. The precise conclusion is that we observed behavior consistent with a documented cloud-compromise pathway.”

Patched, but not everywhere

The Greeter campaign highlights a potential security gap for organizations still running self-hosted Flowise infrastructure. HR and financial software giant Workday acquired the open source project in August 2025 to power its internal AI agent builder capabilities. Exactly one year later, the Flowise platform was sunset, and its GitHub repository was archived.

At the time, developers encouraged teams to fork the repository to maintain their own updates. The project still has roughly 25,000 forks on GitHub.

The final community release of Flowise was version 3.1.4. Because official core support has ceased, any self-hosted instances running vulnerable software face permanent exposure unless organizations manually apply patches.

According to active scanning data from Shodan, 4,372 unique Flowise instances remain visible on the public internet, of which 3,277 reported a recognizable version. Of those, 703 instances had no authentication enabled. Of those unauthenticated deployments, 46 were running the same vulnerable configuration recreated in Era's honeypots.

Running an unauthenticated Flowise deployment is already a major security flaw that exposes AI workflows to unauthorized access. However, Greeter elevates that misconfiguration into full host compromise.

Only a small fraction of exposed Flowise instances match the exact combination of zero authentication and unpatched runtime configurations this exploit requires. However, experts warned that the framework marks an alarming evolution in AI infrastructure targeting. The core risk lies in the route of entry: an ephemeral, log-evading injection technique that turns exposed AI workloads into quiet beachheads for broader cloud account takeover.

In a statement provided to TechTarget Cybersecurity , a spokesperson for Workday clarified the status of the platform following its EOL:

“The Flowise platform was retired on August 31, 2026. Enterprise customers were migrated off, and remaining users are self-hosted. The platform's source code remains available for open source users to build on, though support is no longer available.”

Addressing potential downstream exposure, Roza said: “Any forks that are built on vulnerable versions without the proper patching of fixes are probably also vulnerable to these vulnerabilities.”

Runtime defense: Look past the ‘Hello’

Discussing the campaign, security pros said application-level monitoring is ineffective against attacks that hide inside legitimate API parameters.

“When it comes to Greeter, defenders should ignore application layer detections,” said Crystal Morin, senior cybersecurity strategist at Sysdig. “It creates more noise than signal from that standpoint. The ‘hello’ messages are just a technique to draw attention away from what the threat actor is actually doing ... The real malicious behavior is visible at runtime.”

To catch this kind of activity in progress, Morin recommends security teams monitor specific runtime signals using Linux behavioral tools, such as eBPF and Falco.

“Organizations should also proactively use automated runtime policy enforcement to kill or block shell spawns or egress to metadata IPs,” Morin said. “Detections alert teams after reconnaissance or access has already happened... Assume breach only works if you detect and respond in real time, before a threat actor finishes their operation.”

James Walker is lead editor at TechTarget Cybersecurity.