You Had Me at "Hello": A Chinese‑Language Framework Targeting AI Infrastructure
Comments on “You Had Me at "Hello": A Chinese‑Language Framework Targeting AI Infrastructure”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Era's researchers documented "Greeter," a Chinese-language exploitation framework that abused CVE-2024-58351, an overrideConfig code-injection flaw in the open-source Flowise AI platform. Over July to October 2026, seven honeypots logged attacks that hid malicious commands inside repeated "hello" chat messages, exposing cloud credentials and host data.
Why it ranked
No. 21 of 107 with a score of 0.67. The panel rated it highest on technical depth (0.87) and new information (0.85), lowest on audience breadth (0.62). Placed No. 21, No. 16 by score alone: the ninth Security story of the day (−0.080). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Detailed threat research on exploiting an AI app framework (Flowise CVE) with concrete IoCs and mitigations; substantive and practically useful, but vendor-flavored close and some inferential claims about attacker intent.
- AI judgeJudge 3gpt-5.6-luna
- Substantive honeypot research documents a novel Flowise exploitation framework, exposure measurements, attack flow, IOCs, and mitigations. It is highly actionable for AI infrastructure defenders, though partly promotional and some cloud-compromise outcomes remain hypothetical.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.67total under rubric v2.3
- Significance0.64
- Reader interest0.81
- Audience breadth0.62
- Practical relevance0.83
- Substantiated0.77
- Technical depth0.87
- New information0.85
- Counts against: Promotional0.25
- Counts against: Overclaim0.26
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.69 | 0.45 | 0.78 | 0.64 | 0.33 | +0.24 | +0.154 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.82 | 0.72 | 0.90 | 0.81 | 0.18 | +0.26 | +0.211 |
| Audience breadthHow many people who build technology does it concern? | 0.61 | 0.55 | 0.70 | 0.62 | 0.15 | +0.13 | +0.081 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.90 | 0.70 | 0.88 | 0.83 | 0.20 | +0.22 | +0.182 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.86 | 0.60 | 0.84 | 0.77 | 0.26 | +0.05 | +0.038 |
| Technical depthHow technically substantive is it? | 0.99 | 0.75 | 0.86 | 0.87 | 0.24 | +0.05 | +0.043 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.87 | 0.70 | 0.97 | 0.85 | 0.27 | +0.05 | +0.042 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.09 | 0.35 | 0.32 | 0.25 | 0.26 | −0.19 | −0.048 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.27 | 0.40 | 0.12 | 0.26 | 0.28 | −0.11 | −0.029 |
| Sum of contributions | +0.675 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.675 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-07/21/"><img src="https://rubric.hrih.si/badge/2026-11-07/21.svg" alt="Ranked #21 on Rubric, 7 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 6 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkCausal conclusion
Greeter exploited CVE-2024-58351, a vulnerability in Flowise's runtime configuration mechanism that lets attackers override JavaScript instructions for some API endpoints without modifying the saved chatflow.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “It exploited an old vulnerability (CVE-2024-58351) in Flowise’s runtime configuration mechanism”
The source says No passage could be compared.
Source cited by the article: nvd.nist.gov/vuln/detail/cve-2024-58351
No source givenNumber
Flowise has more than 55,000 GitHub stars and over five million Docker image pulls.
The article gives no link or citation for it.
The article says “Flowise is popular,with more than 55,000 GitHub stars and over five million Docker image pulls”
The source says No source to compare with.
No source givenNumber
A Shodan query identified 4,372 unique Flowise instances exposed to the internet, of which 3,277 reported a recognizable version.
The article gives no link or citation for it.
The article says “we identified 4,372 unique Flowise instances exposed to the internet. Of those, 3,277 reported a recognizable Flowise version”
The source says No source to compare with.
No source givenNumber
Of the 3,277 instances with a recognizable version, 703 (21.5%) had no authentication enabled, and 46 of those (6.5%) appeared to have the same vulnerable conditions as the honeypots.
The article gives no link or citation for it.
The article says “703 (21.5%) had no authentication enabled. More concerningly, 46 of those unauthenticated instances (6.5%), appeared to have the same vulnerable conditions”
The source says No source to compare with.
No source givenBenchmark result
CVE-2024-58351 has a CVSS score of 9.8 and 46 vulnerable hosts (1.4%) out of 3,277.
The article gives no link or citation for it.
The article says “CVE-2024-58351 9.8 overrideConfig code injection 46 (1.4%”
The source says No source to compare with.
Couldn’t checkNumber
The attacker accessed the honeypot from a known TOR exit node (185.246.188.74).
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “the attacker accessed the honeypot from a known TOR exit node (185.246.188[.]74”
The source says No passage could be compared.
Source cited by the article: abuseipdb.com/check/185.246.188.74
No source givenNumber
The attack messages arrived 3.5 seconds apart, each a 'hello' carrying a new command, and a single recon payload produced a 1,048,506-character response chaining 19 commands.
The article gives no link or citation for it.
The article says “A single injected payload generated a 1,048,506-character response (approximately 1 MB). The payload was a shell one-liner chaining 19 commands”
The source says No source to compare with.
No source givenDate
Era's researchers recorded the attacks over two and a half months, from July to October 2026, on seven Flowise honeypots across four regions.
The article gives no link or citation for it.
The article says “recorded the attacks over two and a half months, from July to October 2026, on a network of seven Flowise honeypots across four regions”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 3 pts, not on front page
Recorded for context only, checked 7 Nov 2026, 05:47 UTC. It played no part in the ranking.