Chatflow Import Attack

A scenario where importing a shared workflow file triggers unintended server side execution because the file contains a malicious tool configuration. The risk is strongest when the application enumerates tools or renders imported nodes before the user has taken any explicit action beyond import.

Expanded Definition

Chatflow Import Attack describes a workflow-import abuse pattern in which a shared chatflow, agent graph, or similar orchestration file is treated as data by the user but executed as configuration by the application. The danger appears when import handlers enumerate tools, hydrate nodes, or resolve connectors before the user has completed any explicit trust decision beyond uploading the file. In NHI security terms, the imported artifact can smuggle a malicious tool reference, credential path, or callback target that changes execution context during parsing.

This is adjacent to supply-chain tampering, but it is more specific because the trigger is the import boundary itself, not later runtime compromise. It also differs from ordinary prompt injection because the payload is embedded in structured workflow metadata rather than natural language. Guidance across vendors is still evolving, so definitions vary across products that import agent graphs, visual flows, or chat automations. The safest interpretation is to treat every imported node as untrusted until it has been validated, normalized, and separated from executable tool registration. For broader context on NHI abuse patterns, see the 52 NHI Breaches Analysis and the CISA cyber threat advisories.

The most common misapplication is assuming import is a safe preview step, which occurs when the platform renders imported tools or nodes before validation is complete.

Examples and Use Cases

Implementing chatflow import controls rigorously often introduces friction, because security teams must balance safer onboarding against the convenience users expect from one-click workflow sharing.

• A shared customer-support agent file is imported and immediately displays a tool that points to an external webhook, creating a silent execution path during render.
• A developer uploads a community chatflow that contains a hidden connector to an internal API, and the parser registers it before the owner reviews the configuration.
• An operations team imports a template with a malicious node name that triggers server-side resolution logic, causing credential lookup against an unintended backend.
• A low-trust workflow exchange channel distributes files that look harmless in the UI but embed tool metadata designed to bypass review gates.

In practice, the problem is often found after import format validation is still too shallow. Defenders can compare the pattern with broader AI orchestration risk in the OWASP NHI Top 10 and with tool-abuse tradecraft described in MITRE ATT&CK Enterprise Matrix. Shared flows should be scanned, normalized, and compared against an allowlist before any node is rendered as active.

Why It Matters in NHI Security

Chatflow import attacks matter because they target the trust boundary where non-human identities, tool permissions, and execution logic converge. If an imported workflow can cause server-side action before approval, then the application may expose API keys, invoke privileged connectors, or register an attacker-controlled tool under a legitimate service account. That turns a simple import operation into an identity and authorization problem, not just a file-handling issue.

NHIMG research shows that 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, which makes workflow imports a realistic path for accidental exposure or malicious reuse. The same research also reports that 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface. That combination means a compromised import can have disproportionate blast radius once a workflow is accepted into production. For the governance angle, the Ultimate Guide to NHIs — Key Challenges and Risks is useful for understanding how overprivileged service identities amplify abuse. Organisations typically encounter this term only after an imported flow has already invoked an unintended tool or leaked credentials, at which point chatflow import attack handling becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Attack Surface Management
• Why does Agentic AI make NHI attack surface expand so significantly?
• What is the difference between attack surface management and NHI governance?
• Why do NHIs create a larger attack surface than human users?