GrafanaGhost, where stored data became an instruction and the assistant posted observability data to an external server

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AIL-2026-0019

Kind

Exfiltration

Jurisdiction

Global

Last verified

15 September 2026

Added

15 September 2026

• The research states that because the exploit ignores model restrictions and operates autonomously, sensitive enterprise data can be leaked silently.
• The injected instruction was stored inside the platform's own data, so the agent met it during normal work.
• The outbound request validation was bypassed with a protocol relative URL, meaning a real control existed and was defeated rather than absent.
• Exfiltration happened in the background with no suspicious link for the user to click.
• The core issue was patched after coordinated disclosure.

Identity, Authorization, Limits, Human approval, Revocation, Accountability. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent

Stored log content was read as instruction with no marker separating data from direction.Noma Security, GrafanaGhost, primary source, 7 April 2026.

AuthorizationSilent

The assistant queried what the user could query and applied it to an attacker's goal.Noma Security, GrafanaGhost, primary source, 7 April 2026.

LimitsSilent

A client side restriction on external requests was live and had to be defeated with a protocol relative URL, so the guard was real but insufficient.Noma Security, GrafanaGhost, primary source, 7 April 2026.

Human approvalSilent

The research states the exfiltration ran entirely in the background with nothing presented to the user.Noma Security, GrafanaGhost, primary source, 7 April 2026.

RevocationStated

The core issue was patched by the vendor after disclosure.Noma Security, GrafanaGhost, primary source, 7 April 2026.

AccountabilityStated

Named vendor, coordinated disclosure and a vendor response on the record.Noma Security, GrafanaGhost, primary source, 7 April 2026.

Your own telemetry is untrusted input the moment an assistant reads it, because anything that writes a log line can write an instruction. The control to strengthen is limits, and specifically the URL validation on the outbound side: normalise and resolve every destination before the request, refuse protocol relative and redirecting targets, and hold the allowlist server side where a page cannot reach it.

1. Noma Security, GrafanaGhostPrimary · 7 April 2026

• VerifiedInjectionAIL-2026-0011

  ForcedLeak, a lead form that turned a CRM agent into an exfiltration path through an expired allowlisted domain

  United States · verified 15 September 2026

  Noma Security states that an allowlisted domain had expired and become available for purchase, and that the researchers bought it.

• VerifiedExfiltrationAIL-2026-0020

  SearchLeak, where a crafted link made an enterprise copilot search the victim's own mailbox and push the results out

  United States · verified 15 September 2026

  The research states that the copilot interprets the query parameter as instructions and searches the victim's mailbox.

• AbsentOpen questionAIL-2026-0037

  Has a confirmation prompt ever been documented stopping a destructive agent action in a real incident?

  Global · verified 15 September 2026

  Every incident record in this dataset that involves a destructive or irreversible action records human approval as absent, bypassed or uninformed.

• Open questionOpen questionAIL-2026-0036

  Does any published standard require an agent to hold an identity distinct from the person it acts for?

  Global · verified 15 September 2026

  The Model Context Protocol authorization specification states that clients must implement resource indicators for OAuth so that a token names the resource it is for.

• Open questionOpen questionAIL-2026-0035

  Does any registry classify AI incidents by the authority control that failed, and does anyone count agent incidents?

  Global · verified 15 September 2026

  The AI Incident Database describes itself as indexing the collective history of harms or near harms realised in the real world by deployed AI systems.

• Open questionOpen questionAIL-2026-0034

  Who is liable when an agent commits its principal to something false or binding?

  Global · verified 15 September 2026

  The Canadian tribunal decision is a small claims level decision and is not binding precedent on other courts.