EE
FR Contact

ForcedLeak: web-form injection could make Salesforce Agentforce leak CRM data

Proof of concept Manipulation Severity 3 significant Corroborated 82%

Noma Labs showed that an attacker could hide instructions in the description field of a Salesforce Web-to-Lead form; when an employee later asked Agentforce about the lead, the agent followed them and embedded CRM data, such as leads' email addresses, in an image request to an external server. The exfiltration worked because a domain on Agentforce's content security policy allowlist had expired and could be bought. Salesforce re-secured the domain and released patches enforcing Trusted URLs so agent output cannot be sent to untrusted URLs.

Noma rated the chain critical (CVSS 9.4) and reported it on 28 July 2025; Salesforce acknowledged it on 31 July. Any organisation using Agentforce with Web-to-Lead enabled could have been affected.

What would have stopped it

Maintain a verified allowlist of trusted URLs for agent output and treat form submissions as untrusted data.

Guardrails

1 of 8 failed
  1. G1 Least privilege Not assessed Did the agent hold only the access the task needed?
  2. G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
  3. G3 Isolation Partial The content security policy limited outbound domains but allowlisted an expired, purchasable domain.
  4. G4 Instruction integrity Failed The agent executed instructions hidden in an external Web-to-Lead submission.
  5. G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
  8. G8 Recovery Not assessed Could the damage be undone?

Sources

1 primary, 1 specialist
  1. ForcedLeak: AI agent risks exposed in Salesforce Agentforce Noma Security, 25 Sep 2025
    “This research outlines how Noma Labs discovered ForcedLeak, a critical severity (CVSS 9.4) vulnerability chain in Salesforce Agentforce that could enable external attackers to exfiltrate sensitive CRM data through an indirect prompt injection attack.”
    Primary Quote checked Archived copy
  2. Salesforce AI Hack Enabled CRM Data Theft SecurityWeek, 25 Sep 2025
    “Prompt injection and an expired domain could have been used to target Salesforce’s Agentforce platform for data theft.”
    Specialist Quote checked Archived copy

Confidence 82% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 2 sources

Similar failures

All incidents
  1. EEAIR-2026-049 Oct 2026 Researchers say AGENTS.md files can hijack Codex and Claude Code agents OpenAI Codex and Claude Code, OpenAI, AnthropicProof of concept 55%
  2. EEAIR-2025-029 Nov 2025 WSJ journalists talk a Claude vending agent into giving away its stock and a PlayStation 5 Claudius (Claude), Anthropic and Andon Labs 96%
  3. EEAIR-2025-042 Oct 2025 URL-like strings pasted into ChatGPT Atlas's omnibox run as trusted agent commands ChatGPT Atlas browser (agent mode), OpenAIProof of conceptEU 82%