GrafanaGhost shows how agentic dashboards can silently leak data

At a glance

What this is: This is an analysis of GrafanaGhost, a silent exfiltration path in Grafana that uses indirect prompt injection and URL parsing flaws to leak sensitive dashboard data.

Why it matters: It matters because dashboards increasingly sit on top of high-value telemetry and business data, and IAM, NHI, and AI governance teams need controls that survive model-mediated access paths.

Context

GrafanaGhost is a dashboard security failure, but the real problem is governance at the boundary between rendered content, user-controlled input, and model-mediated actions. When a platform lets an AI component process untrusted context and then act on it, traditional validation assumptions stop holding.

In this case, the article shows that a seemingly ordinary Grafana interaction can be turned into background data leakage without a click or obvious alert. That makes it relevant to NHI and agentic AI governance because the security decision is no longer just who can log in, but what the system is allowed to fetch, render, and forward on behalf of a user.

The article’s core claim is that layered controls can still be defeated when client-side checks, prompt handling, and URL parsing each make different assumptions about trust. For identity teams, that is the warning signal: the control plane and the data plane are now intertwined in ways most review processes do not model.

Key questions

Q: What breaks when dashboards let AI components make outbound requests?

A: The separation between viewing data and sending data breaks. If an AI component can interpret stored content and trigger external fetches, then a dashboard interaction can become a data-exfiltration path without a user click. Security teams should treat that as a trust-boundary failure, not just an application bug.

Q: Why do protocol-relative URLs create security risk in browser-based validation?

A: They can satisfy simplistic string checks while still resolving to an external destination in the browser. That creates a gap between what the application thinks it allowed and what the browser actually requests. The fix is canonicalisation and server-side origin checking before rendering or fetch approval.

Q: How do indirect prompt injections change the risk profile of dashboards?

A: They let attacker-controlled text become an instruction source for the model. That means labels, paths, and stored prompts can steer the system into actions that were never intended by the user or the operator. Teams need to govern model input as a control surface, not just as content.

Q: What do organisations get wrong about AI guardrails?

A: Many teams assume a policy filter alone can prevent harmful output, but adversarial prompting shows that language models can be steered around obvious controls. The common mistake is treating guardrails as a static filter list instead of a system of content separation, monitoring, and authorisation boundaries.

Technical breakdown

Indirect prompt injection in dashboard workflows

Indirect prompt injection happens when attacker-controlled content is stored or retrieved by a system and later interpreted as instructions by an AI component. In a dashboard context, that means benign-looking fields such as paths, labels, or log entries can become executable influence over model behaviour. The risk is not just bad output. It is that the model can be steered into making external requests, combining user context with sensitive data, and bypassing the intended separation between display logic and action logic.

Practical implication: treat any user-controlled or externally sourced dashboard content as untrusted model input, not just display data.

Protocol-relative URL bypasses and client-side validation

The article’s bypass depends on a common parsing mismatch. A string that starts with // can satisfy a naive startsWith('/') check while still resolving in the browser as an external absolute URL. That means a client-side allowlist can approve what the browser will later interpret as outbound traffic. This is a control failure in URL canonicalisation, not just a coding bug. Once the browser resolves the target, the request can carry sensitive parameters to an attacker-controlled server.

Practical implication: validate and canonicalise URLs on the server side before any render or fetch decision is made.

Model guardrails as a brittle security boundary

GrafanaGhost also shows that model guardrails are not a reliable standalone control boundary. The article describes how specific wording, including the keyword INTENT, altered model behaviour enough to bypass refusal logic. That illustrates a deeper problem: prompt-sensitive protections are often reactive pattern matching, not durable authorisation. If the model can be nudged into processing malicious instructions, the application has effectively outsourced security decisions to a layer that is easy to manipulate and hard to verify.

Practical implication: do not treat prompt filters or refusal behaviour as a substitute for enforceable request policy.

Threat narrative

Attacker objective: The attacker wants to exfiltrate sensitive enterprise data from Grafana while remaining invisible to users and defenders.

1. Entry occurs through stored or reflected user-controlled content in Grafana paths and entry logs that later reaches the AI processing layer.
2. Credential or data exposure follows when the model is induced to render an external resource and attach sensitive dashboard data to the outbound request.
3. Escalation happens as protocol-relative URL parsing and prompt wording bypass both client-side restrictions and model guardrails, enabling automatic exfiltration.
4. Impact is silent leakage of financial metrics, infrastructure telemetry, and customer data to an attacker-controlled server without user clicks or obvious alerts.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Model-mediated dashboards create a new trust boundary that IAM programmes do not currently model well. GrafanaGhost is not just an application flaw. It shows that when an AI component can read context and trigger outbound requests, the control question shifts from user authentication to request authorisation across the model boundary. The practical conclusion is that dashboards with agentic features need explicit governance for what the model may fetch, render, and disclose.

Client-side validation is not a security control when the browser remains the final parser. The protocol-relative URL bypass works because a string check and a browser URL resolver are not the same thing. That mismatch is common in modern applications that mix front-end sanitisation with model-generated output. The implication is that teams must treat canonicalisation as a security dependency, not a coding style issue.

Indirect prompt injection collapses the assumption that safe input stays non-executable. GrafanaGhost shows that stored text, paths, and labels can become instructions once an AI layer interprets them. That breaks the old separation between content and command. The result is a governance gap where review processes inspect data sources but not the latent actions those sources can trigger.

Prompt guardrails are a fragile compensating control, not an identity boundary. The article’s INTENT keyword bypass suggests that model refusal behaviour can change with phrasing, which makes it unsuitable as the final enforcement layer. For practitioners, the important concept is the runtime trust debt created when AI behaviour is allowed to stand in for policy enforcement.

GrafanaGhost widens the identity perimeter around dashboards, because the system itself becomes an acting subject. That means NHI governance has to account for machine-initiated external calls made in the context of user data, even when no credentials are stolen. The practitioner takeaway is that access control, rendering control, and model control now need to be assessed together.

What this signals

Runtime trust debt: When a dashboard can interpret untrusted context and then make external calls, the programme accumulates trust debt at runtime instead of at provisioning time. That changes the security conversation from identity issuance to action authorisation, which is where many AI-enabled interfaces are weakest.

For identity and security teams, GrafanaGhost is a reminder that data access, render logic, and model behaviour now form one operational surface. The programme implication is straightforward: if a control only works before the model sees the content, it is too early to contain the risk.

For practitioners

• Define outbound request boundaries for model-mediated dashboards Restrict which domains, schemes, and resource types a dashboard or embedded model may contact on behalf of a user. Make outbound fetches explicit, logged, and policy-controlled rather than inferred from rendered content.
• Canonicalise URLs before any allowlist decision Normalize and parse candidate URLs on the server side, then compare the resolved origin rather than the raw string. Reject protocol-relative paths, ambiguous schemes, and any value that changes meaning after browser parsing.
• Separate dashboard rendering from model execution Keep AI summarisation, extraction, and external-request capability outside the same trust zone as sensitive telemetry and business metrics. If a model can see the data, it must not automatically be able to act on it.
• Instrument silent-exfiltration indicators Alert on unexpected external image loads, query-string data blobs, and model-triggered requests that occur after ordinary dashboard interactions. Treat those signals as data-loss events, not merely unusual application traffic.
• Review prompt handling as part of NHI governance Map any model-driven dashboard feature to the identities, tokens, and service paths it can invoke. Include offboarding, scope review, and third-party dependency checks for those machine-mediated flows.

Key takeaways

• GrafanaGhost shows that a dashboard can leak data even when no user clicks and no obvious exploit chain is visible to defenders.
• The exploit succeeds by combining indirect prompt injection with URL parsing weakness and prompt-sensitive guardrail bypass, which demonstrates how layered controls can fail together.
• Practitioners need controls that govern model-mediated outbound requests, because once the system itself can act on untrusted context, the data plane becomes part of the attack surface.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Protocol-Relative URL: A URL form that begins with double slashes and inherits the current scheme from the page. It can look like a local or harmless path to weak validators while the browser resolves it to an external destination, which makes it a common parsing bypass in web security.
• Model guardrails: Safety and abuse controls designed to prevent a model from helping with harmful requests. In practice, guardrails include prompt filtering, policy enforcement, tool restrictions, and monitoring for misuse patterns that indicate the model is being steered into malicious support.
• Silent Exfiltration: Data loss that happens through normal-looking agent actions rather than obvious malware or alarm-triggering behaviour. Because the agent may summarise, forward, or copy sensitive information as part of a legitimate workflow, detection depends on boundary controls and auditability, not just threat signatures.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.