incidents.si
INC-2025-0016SEV2 · High (potential)prompt-injectionresearch-demo

ForcedLeak: a web form could make Salesforce Agentforce send out CRM data

Noma Security showed that text submitted through a public lead form could instruct Agentforce to send CRM data to an expired domain that Salesforce’s policy still trusted.

Disclosed
Published
Organization
Salesforce
System
Salesforce Agentforce with Web-to-Lead enabled
Impact
Possible exfiltration of CRM data; no exploitation in the wild reported

Timeline

  • 2025-07-28. Noma reports the issue to Salesforce.
  • 2025-07-31. Salesforce acknowledges the report.
  • 2025-09-08. Salesforce enforces trusted URLs for Agentforce and Einstein AI.
  • 2025-09-25. Noma publishes its findings.

Trigger or entry point

A submission to a public Web-to-Lead form, with instructions for the agent in the description field.

Failure mechanism

When an employee later asks Agentforce about the lead, the agent reads the description and follows the instructions in it. Salesforce’s content security policy allowed images from a list of domains. One domain on the list had expired and could be bought; Noma registered it for $5. The injected instructions made the agent output an image link to that domain with CRM data in the address. The description field accepts up to 42,000 characters, which left room for a long set of instructions.

Impact

Noma rates the issue 9.4 on the CVSS scale. Its proof of concept extracted lead email addresses. None of the sources reports exploitation in the wild. The severity is potential. Beyond email addresses, Noma lists customer contact details, sales pipeline data, internal communications and interaction history as data an attacker could have reached.

Response

Salesforce re-secured the expired domain and released patches that stop Agentforce output from being sent to untrusted URLs. In a statement quoted by Infosecurity Magazine, Salesforce said it was aware of the vulnerability reported by Noma.

Mitigations

Enforcement of the trusted URL list on the Salesforce side.

Sources

  1. ForcedLeak: AI agent risks exposed in Salesforce Agentforceprimary · 2025-09-25
  2. Critical Vulnerability in Salesforce AgentForce Exposedsecondary · 2025-09-25
  3. ForcedLeak flaw in Salesforce Agentforce exposes CRM data via Prompt Injectionsecondary · 2025-09-27

Corrections

No corrections have been made to this entry.

Report a correction