By hiding malicious instructions on an attacker-controlled Web page, AI could ingest orders that appear benign but return sensitive data to the attacker's server.
An issue with observability platform Grafana would have enabled attackers to trick its AI capabilities into leaking sensitive data.
Grafana is a popular observability platform used to compile and track business data tied to finances, telemetry, operations, infrastructure, customer, and more. Because the platform's nature inherently connects it to the center of an organization's most valuable information, compromising a Grafana instance could prove devastating.
AI security vendor Noma today published research concerning "GrafanaGhost," an indirect prompt injection attack researchers discovered that could allow a threat actor to exfiltrate data.
The attack leans on how Grafana's AI components process information. In short, an attacker would hide malicious instructions on a Web page they control, and through trickery in terms of how the instructions are presented, the AI ingests the orders as benign and inadvertently sends requested sensitive data back to an attacker-controlled server.
The user of Grafana's AI assistant would access an attacker-crafted URL path and Grafana would ingest the prompt as soon as a malicious image file began to load.
The core technical issue enabling GrafanaGhost has been patched.
After some troubleshooting, Noma found where indirect prompts are processed and identified image tags as a viable avenue for making a malicious command. Although external images have protections on them to prevent attacks like this, researchers managed to bypass said protections by using protocol-relative URLs to circumvent domain validation and the "INTENT" keyword to disable AI model guardrails, which at the time caused Grafana to inadvertently see an external prompt as benign.
With the right setup, data is exfiltrated with the victim unaware as soon as the image starts being rendered.
As Sasi Levi, security research lead at Noma Security, tells Dark Reading, this doesn't necessarily require getting a defender to click a link that loads a malicious page.
"[The attacker needs] to get their indirect prompt stored in a location that Grafana's AI components will later retrieve and process," he says. "Once that payload is sitting in the data store, it waits and fires automatically when any user performs a normal interaction with their Grafana instance (like browsing entry logs). The user is the unwitting trigger, not the target of a phishing attempt. That's what makes it so stealthy."
Noma praised Grafana for its response. After Noma followed responsible disclosure protocols, Grafana "jumped on the issue immediately, worked closely with us to validate the findings, and rolled out a fix as fast as possible to secure their users."
However, the company disputes the claim that the attack constitutes "zero-click," as Noma described it, or that it could operate silently and autonomously in the background.
"Any successful execution of this exploit would have required significant user interaction — specifically, the end user would have to repeatedly instruct our AI assistant to follow malicious instructions contained in logs, even after the AI assistant made the user aware of the malicious instructions," McManus says. "We emphasize that there is no evidence of this bug having been exploited in the wild, and no data was leaked from Grafana Cloud."
Noma's Levi responded to Grafana's claims over email. He tells Dark Reading that the exploit requires "fewer than two steps" and that the AI never surfaced any warning to the user about the presence of malicious instructions in the entry log.
"There was no alert, no flag, no prompt asking the user to confirm. The model processed the indirect prompt injection autonomously, interpreting the log content as legitimate context and acting on it silently, without restriction, and without notifying the user that anything unusual was occurring," Levi says. "The user had no visibility into what was happening in the background and no opportunity to intervene."
He continues, "We respect Grafana's quick response to the patch and their commitment to user security. But we can't let an inaccurate characterization of the exploit mechanics stand unchallenged. The findings are documented, and we're confident in what the research shows."
An issue with observability platform Grafana would have enabled attackers to trick its AI capabilities into leaking sensitive data.
Grafana is a popular observability platform used to compile and track business data tied to finances, telemetry, operations, infrastructure, customer, and more. Because the platform's nature inherently connects it to the center of an organization's most valuable information, compromising a Grafana instance could prove devastating.
AI security vendor Noma today published research concerning "GrafanaGhost," an indirect prompt injection attack researchers discovered that could allow a threat actor to exfiltrate data.
The attack leans on how Grafana's AI components process information. In short, an attacker would hide malicious instructions on a Web page they control, and through trickery in terms of how the instructions are presented, the AI ingests the orders as benign and inadvertently sends requested sensitive data back to an attacker-controlled server.
The user of Grafana's AI assistant would access an attacker-crafted URL path and Grafana would ingest the prompt as soon as a malicious image file began to load.
The core technical issue enabling GrafanaGhost has been patched.
How GrafanaGhost Works
The prompt injection resulted from Noma wanting to know where a user could potentially interact with Grafana's AI components, as anything user-facing is an opportunity for a prompt injection attack.After some troubleshooting, Noma found where indirect prompts are processed and identified image tags as a viable avenue for making a malicious command. Although external images have protections on them to prevent attacks like this, researchers managed to bypass said protections by using protocol-relative URLs to circumvent domain validation and the "INTENT" keyword to disable AI model guardrails, which at the time caused Grafana to inadvertently see an external prompt as benign.
With the right setup, data is exfiltrated with the victim unaware as soon as the image starts being rendered.
As Sasi Levi, security research lead at Noma Security, tells Dark Reading, this doesn't necessarily require getting a defender to click a link that loads a malicious page.
"[The attacker needs] to get their indirect prompt stored in a location that Grafana's AI components will later retrieve and process," he says. "Once that payload is sitting in the data store, it waits and fires automatically when any user performs a normal interaction with their Grafana instance (like browsing entry logs). The user is the unwitting trigger, not the target of a phishing attempt. That's what makes it so stealthy."
Noma praised Grafana for its response. After Noma followed responsible disclosure protocols, Grafana "jumped on the issue immediately, worked closely with us to validate the findings, and rolled out a fix as fast as possible to secure their users."
Grafana Responds to GrafanaGhost
Grafana Labs chief information security officer (CISO) Joe McManus tells Dark Reading in an email that Noma's research highlighted an issue with Grafana's image renderer in its Markdown component, which was "quickly patched."However, the company disputes the claim that the attack constitutes "zero-click," as Noma described it, or that it could operate silently and autonomously in the background.
"Any successful execution of this exploit would have required significant user interaction — specifically, the end user would have to repeatedly instruct our AI assistant to follow malicious instructions contained in logs, even after the AI assistant made the user aware of the malicious instructions," McManus says. "We emphasize that there is no evidence of this bug having been exploited in the wild, and no data was leaked from Grafana Cloud."
Noma's Levi responded to Grafana's claims over email. He tells Dark Reading that the exploit requires "fewer than two steps" and that the AI never surfaced any warning to the user about the presence of malicious instructions in the entry log.
"There was no alert, no flag, no prompt asking the user to confirm. The model processed the indirect prompt injection autonomously, interpreting the log content as legitimate context and acting on it silently, without restriction, and without notifying the user that anything unusual was occurring," Levi says. "The user had no visibility into what was happening in the background and no opportunity to intervene."
He continues, "We respect Grafana's quick response to the patch and their commitment to user security. But we can't let an inaccurate characterization of the exploit mechanics stand unchallenged. The findings are documented, and we're confident in what the research shows."