Flow AI with Veo3 by Google Labs: A Network Traffic Analysis

Flow AI Google’s latest AI-powered creative platform is designed to generate images, storyboards and video from text prompts. It’s integrated with Veo3, Google’s latest and advanced video creation model. Veo3 is designed to create high quality, cinematic videos from text or image prompts. Launched at Google I/O in May 2025, as of July 2025 Flow AI is available in 140+ countries via Google AI pro and AI ultra subscription and since launch, Google reported that users have created over 40 million AI-generated videos with Veo 3.

Network Traffic Analysis

The ATI team has analyzed the network capture of Flow AI. The captured traffic was completely TLS 1.3 encrypted. We have further analyzed the traffic based on host names.

Overall Analysis

We have performed extensive user interactions with Flow AI over approximately 10 minutes in a single session. The actions include launching the webpage, creating a new project, prompting the Veo 3 model to generate a video, played the generated video. We then switched to the Veo 3- Fast model to use audio with video, played the video again and finally logged out. We have further analysed the traffic based on host names.

Figure 1: Request-Response count per host

In the figure above we observe the maximum number of request-responses was seen by labs.google followed by lh3.googleusercontent.con and aisandbox-pa.googleapis.com

While the first host was used frequently for project configuration, media management, user preference and logs, auth sessions, the second host was used to server static content, mainly images, and aisandbox-pa.googleapis.com is associated with Google AI sandbox, most likely model inference APIs, Google AI experiments tied to Veo, Google Labs, Bard or Gemini.

Figure 2: Cumulative payload per host

Analyzing Endpoints

By examining the HAR file, we gain a detailed view of the HTTP requests and responses between the client and Flow AI servers. This analysis focuses on critical endpoints and their roles in the platform's functionality.

Fetch Projects:

Figure 3: GET request for loading projects

• Endpoint: /fx/_next/data/eVHN8UaiK2ThAHJBmKcPD/en/tools/flow/project/[projectId].json
• Method: GET
• Purpose: Fetches the project data associated with the provided projectId. The endpoint is likely used to load project specific metadata, configurations and status.
• Request Headers:
  • Accept: */*
• Query Parameter:
  • projectId: [projectId]
• Response:
  • HTTP Status: 200 OK
  • Response data: A compressed JSON payload containing project metadata & state, the project id and an embedded query stub for project.getProject

Video Generation:

Figure 4: Post request for video generation

• Endpoint: /v1/video:batchAsyncGenerateVideoText
• Method: POST
• Purpose: This endpoint initiates asynchronous video generation based on user-provided text prompts. It allows submitting multiple prompts in a single batch request to produce AI generated videos.
• Request Headers:
  • Content-Type: text/plain; charset=UTF-8
• Request Body: JSON payload with:
  • clientContext: includes the project Id.
  • Requests: array of prompt generation requests containing:
    • aspectRatio: e.g., VIDEO_ASPECT_RATIO_LANDSCAPE.
    • seed: numeric value for randomization.
    • textInput.prompt: user text prompt describing the desired video.
    • videoModelKey: specifies the model variant, here "veo_2_1_fast_d_15_t2v".
    • metadata.sceneId: unique identifier for each scene.
• Response Status: 200 OK
• Response Body: JSON containing
  • Operations: each with an operation.name and sceneID
  • remainingCredits: 960 (indicating the free tier credits)

Model Configuration:

Figure 6: GET request for retrieving the available models

• Endpoint: /fx/api/trpc/videoFx.getVideoModelConfig
• Method: GET
• Purpose: It retrieves the list of available video generation models and their configurations for Flow AI. This enables the frontend to display model options like Veo2, Veo3 and their respective features (audio, upscaling, quality levels).
• Request Headers:
• Content-Type: application/json
• Response Status: 200 OK
• Response Body: Contains a detailed list of video models, including
  • Veo 3 Fast (Text to Video + Audio):
    • Key: veo_3_0_t2v_fast
    • Capabilities: [“VIDEO_MODEL_CAPABILITY_TEXT”, “VIDEO_MODEL_CAPABILITY_AUDIO”]
    • videoLengthSeconds: 8
    • creditCost: 20
    • generationTime: 100ms
  • Veo 3 Quality:
    • Key: veo_3_0_t2v_pro
    • Capabilities: [“VIDEO_MODEL_CAPABILITY_TEXT”, “VIDEO_MODEL_CAPABILITY_AUDIO”]
    • videoLengthSeconds: 8
    • creditCost: 100
    • generationTime: 210ms

User History:

Figure 7: Post request for FlowAI history

• Endpoint: /fx/api/trpc/media.fetchUserHistoryDirectly
• Method: GET
• Purpose: Fetches the user’s media history from the Flow AI system, including previously generated assets such as videos or images. It is likely used to populate the user’s asset management interface.
• Response Status: 200 OK
• Response Body: A Json with the status of the request and result set.

Performance and Latency

In the observed trace, Flow AI operates over HTTP/3, benefiting from reduced latency and improved request multiplexing. Static assets load rapidly via Google’s CDN, typically under 100ms. Core API calls, including prompt submissions and model configuration average between 200ms to 1.5 seconds, which is expected give the backend AI processing involved with models like Veo3. Video generation APIs introduce higher latencies due to the computational weight of LLM and multimodal processing.

NOTE: While Flow AI can be useful, it is a prohibited tool by many companies and government entities. Policy and technical systems must be in place to prevent usage, and it is vital to confirm this via tests using BreakingPoint. These tests help validate the security measures and help organizations prevent accidental or malicious use of the platform.

Flow AI Traffic Simulation in Keysight ATI

At Keysight Technologies Application and Threat Intelligence (ATI), since we always try to deliver the hot trending application, we have published the FlowAI application in ATI-2025-13 which simulates the HAR collected from the FlowAI web application as of June 2025 including different user actions like performing text-based queries, uploading multimedia files, using the generate image feature to create custom visuals and refining search results. Here all the HTTP transactions are replayed in HTTP/2 over TLS1.2.

Figure 8: Flow AI Jun25 HAR Replay HTTP/2 over TLS1.2 Superflow in BPS  

Flow AI application and its 4 new Superflows as shown below:

Figure 9: Flow AI App and its Superflows in BPS

Leverage Subscription Service to Stay Ahead of Attacks

Keysight's Application and Threat Intelligence subscription provides daily malware and bi-weekly updates of the latest application protocols and vulnerabilities for use with Keysight test platforms. The ATI Research Centre continuously monitors threats as they appear in the wild. Customers of BreakingPoint now have access to attack campaigns for different advanced persistent threats, allowing BreakingPoint Customers to test their currently deployed security control's ability to detect or block such attacks.

Related Content

Related Posts