Incident Overview
On April 7, 2026, Noma Security disclosed a vulnerability in Grafana’s AI companion feature, dubbed GrafanaGhost. This flaw allowed attackers to bypass client-side protections and security guardrails, enabling the exfiltration of enterprise telemetry data through manipulated image rendering requests. Grafana, an open-source analytics and visualization platform widely used in enterprise environments, often processes sensitive data such as financial metrics, infrastructure logs, customer information, and telemetry. The vulnerability exploited Grafana’s AI capabilities to encode and transmit this data to external servers without direct user interaction, effectively turning the platform into an unwitting data exfiltration vessel.
The attack leveraged a combination of prompt injection and a flaw in Grafana’s markdown image-rendering path. By crafting malicious prompts embedded within external resources, attackers could instruct Grafana’s AI companion to ignore its built-in safeguards. This was achieved by exploiting a validation flaw in the function responsible for processing image URLs, which allowed external domains to be acknowledged despite Grafana’s default protections against such requests. The data exfiltration occurred when the AI companion attempted to render an image, appending sensitive information as URL parameters in the request sent to the attacker’s server.
Grafana Labs confirmed the vulnerability and issued a patch within a day of being notified. The company clarified that exploitation required substantial user interaction, contradicting Noma Security’s claim of a zero-click attack. Grafana Labs stated that successful exploitation would necessitate repeated malicious instructions from the user, even after the AI assistant had already flagged the suspicious activity. Despite this, the vulnerability underscored broader risks associated with AI-driven tools processing untrusted input without adequate architectural controls.
The incident highlighted the growing challenge of securing AI components in enterprise environments. While Grafana has protections in place to prevent the loading of images from external domains, the flaw demonstrated how attackers could bypass these measures through indirect prompt injections. The use of keywords like ‘intent’ to manipulate the AI model into processing malicious instructions further complicated defenses, as such techniques could evade traditional guardrails designed to block unauthorized image rendering.
BeyondTrust’s deputy CISO, Bradley Smith, noted that the exploitability of GrafanaGhost depended heavily on deployment specifics, including whether AI features were enabled, the presence of egress controls, and how external data ingestion was managed. He emphasized that the vulnerability was not a universal bypass but rather an example of risks arising when AI components process untrusted input without sufficient safeguards. Acalvio’s CEO, Ram Varadarajan, reinforced this point, arguing that perimeter controls alone were insufficient and that runtime behavioral monitoring of AI-driven tooling was essential to mitigate such threats.
Grafana Labs has stated there is no evidence that the vulnerability was exploited in the wild or that data was leaked from Grafana Cloud. While the patch addressed the immediate risk, the incident served as a case study for the broader challenges of securing AI-assisted tools in enterprise observability platforms, particularly those handling sensitive infrastructure and customer data.
Possible Root Cause
The first flaw resided in the validation mechanism for image URLs, which failed to adequately enforce restrictions on external domains. Grafana’s default protections were designed to block image loading from external sources, but the validation function contained a gap that allowed attackers to bypass these controls by crafting malicious image paths.
The second flaw involved the AI model’s guardrails, which were intended to prevent prompt injection attacks targeting image markdown. However, Noma Security discovered that attackers could manipulate the model by embedding specific keywords, such as ‘intent,’ within their prompts. This manipulation tricked the AI companion into processing instructions that would otherwise be flagged as malicious, effectively bypassing the guardrails and enabling unauthorized image rendering requests. The use of indirect prompts hidden in external resources further exacerbated the issue, as these prompts could be triggered without direct user awareness.
The attack chain began with an attacker crafting a path pointing to an external resource, which was then processed by Grafana when a user interacted with an entry log. The malicious prompt embedded in this resource instructed the AI companion to ignore its guardrails and render an image from an external URL controlled by the attacker. During this process, sensitive enterprise data—such as telemetry or dashboard metrics—was encoded into the image request as a URL parameter. When the AI companion attempted to render the image, the data was inadvertently transmitted to the attacker’s server, completing the exfiltration.
While Grafana Labs argued that exploitation required substantial and repeated user interaction, Noma Security’s research demonstrated that the attack could be automated to a significant extent. The use of saved prompts within Grafana’s data store allowed attackers to persistently trigger the vulnerability, reducing the need for continuous manual intervention. This persistence capability made the attack more insidious, as data exfiltration could occur in the background without immediate detection.
The vulnerability also exposed broader architectural weaknesses in Grafana’s handling of untrusted input. The AI companion’s design assumed that guardrails and validation mechanisms would suffice to prevent misuse, but the GrafanaGhost attack revealed that these controls could be circumvented through carefully crafted prompts and exploitation of validation gaps. This incident underscored the need for more robust input sanitization, runtime monitoring of AI-driven actions, and stricter controls over external data ingestion in enterprise observability platforms.
Takeaways
- Prompt Injection Remains a Critical Risk in AI-Driven Tools: The GrafanaGhost vulnerability demonstrated how attackers can manipulate AI models to bypass security guardrails through indirect prompt injections. This technique, which involves embedding malicious instructions in external resources or using specific keywords to trick the model, highlights the need for more sophisticated detection and prevention mechanisms. Organizations deploying AI-assisted tools must implement runtime behavioral monitoring to identify and block unauthorized actions, even when traditional guardrails appear intact.
- Validation Mechanisms Must Be Rigorously Tested: The flaw in Grafana’s image URL validation function revealed that even well-intentioned security controls can be exploited if not thoroughly vetted. Attackers exploited a gap in the validation logic to bypass restrictions on external image loading, demonstrating that security measures must be continuously audited and updated. Organizations should adopt a defense-in-depth approach, combining multiple layers of validation and monitoring to reduce the risk of such bypasses.
- User Interaction Does Not Guarantee Security: While Grafana Labs emphasized that exploitation required substantial user interaction, the GrafanaGhost attack showed that persistence techniques—such as saved prompts—could automate much of the process.
- AI Security Extends Beyond Application-Level Protections: The incident reinforced the need for network-level defenses, such as URL blocking and egress controls, to complement application-layer security. Perimeter controls alone are insufficient when AI components process untrusted input, as demonstrated by the ability to exfiltrate data through manipulated image requests. Organizations should adopt a holistic security strategy that includes runtime monitoring of AI actions, behavioral analysis, and strict enforcement of data access policies.
- Enterprise Observability Platforms Are High-Value Targets: Grafana’s role in handling sensitive enterprise data—such as infrastructure telemetry, financial metrics, and customer information—makes it an attractive target for attackers seeking to exfiltrate valuable information. The GrafanaGhost vulnerability serves as a warning that observability platforms, which often have broad access to critical systems, must be secured with the same rigor as other high-risk applications.
- As AI-driven tools become more integrated into enterprise workflows, organizations must continuously update their security policies, monitoring capabilities, and incident response strategies. This includes treating AI agents as highly privileged identities, implementing strict access controls, and ensuring that runtime behaviors align with intended use cases.