Noma Security hid a prompt injection in a Salesforce web form and made Agentforce leak CRM data to a $5 expired domain. A lab demo, fixed in Sept 2025.
Social Engineering Examples·9 sources
ForcedLeak showed how a prompt injection in a public web form could make Salesforce's Agentforce AI leak CRM data. Researchers at Noma Security hid instructions in the Description field of a Web-to-Lead form, the kind companies put on their websites to collect sales leads. When the AI agent was later asked about that lead, it followed the hidden instructions and sent lead email addresses to a domain Salesforce still trusted, which Noma had bought for about $5. It was a lab demo in Noma's own Salesforce setup. Salesforce fixed it on 8 September 2025. Status: Research disclosure; no one attacked.
| Step | What happened in Noma's test |
|---|---|
| Plant | Submit a public Web-to-Lead form with a multi-step instruction hidden in the Description field. Noma measured it accepting up to 42,000 characters |
| Wait | The lead sits in the CRM looking like ordinary data |
| Trigger | Noma ran the kind of question an employee might ask, about a lead under the invented name "Alice Bob" |
| Obey | The agent read the Description as part of its context, couldn't tell instructions from data, and gathered CRM lead and contact details |
| Leak | It wrote an image tag pointing at cdn.my-salesforce-cms.com, with email addresses in the URL. When the browser loaded the "image", the data went to Noma's server |
Why did the browser allow that request? Salesforce's Content Security Policy for Agentforce and Einstein still trusted *.my-salesforce-cms.com, an old domain whose registration had lapsed. Noma bought it. The policy checked where the request went, not what it carried.
The 42,000-character figure is Noma's measurement in its own test org. Salesforce doesn't publish that limit.
Tip: if a field anyone can fill in from the internet ends up in front of your AI agent, treat everything in it as hostile.
| Date (2025) | Event |
|---|---|
| 28 July | Noma reports the flaw to Salesforce |
| 31 July | Salesforce acknowledges it |
| 8 September | Salesforce starts enforcing Trusted URL Allowlisting for Agentforce and Einstein AI, and re-secures the lapsed domain |
| 25 September | Noma publishes the full write-up |
Salesforce shipped the fix as an ordinary Winter '26 release note, not a named security advisory, and reportedly didn't directly credit Noma. It didn't say whether any customer had been affected before the fix.
ForcedLeak fits what Simon Willison called the "lethal trifecta" for AI agents: untrusted input (a public form), access to private data (the CRM) and a way to send data out (images from trusted domains). Old web defences weren't built to stop a model treating data as orders.
The domain trick travels well. Any domain ever added to an AI system's allowlist is a standing risk if its registration lapses. Anyone can buy it and inherit the trust.
Keep the source in mind, too. Noma ran the test, scored it and published it as marketing for its own AI security product. That doesn't make it wrong. It does make it a demonstration, not an incident.
See also prompt injection, agentic AI attacks and OpenClaw.
A 2025 Noma Security demonstration showing that a prompt injection hidden in a Salesforce Web-to-Lead form could make Agentforce leak CRM data to an expired, still-trusted domain.
No breach was reported. Noma ran it in its own test setup, and Salesforce didn't say whether any customer was affected before the fix.
It enforced Trusted URL Allowlisting for Agentforce and Einstein AI from 8 September 2025 and took back the expired domain.
No. Noma rated it 9.4 on its own calculation, but no CVE was assigned.
Social Engineering Examples. “ForcedLeak: a web form prompt injection that made Salesforce Agentforce leak data (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/forcedleak-salesforce-agentforce-2025
Noma researchers documented probing Agentforce's operational boundaries with general-knowledge test queries, then systematically checked each Web-to-Lead form field's character limit to find one large enough for a multi-step instruction payload, settling on the Description field's 42,000-character allowance after finding name/company/email fields too short (40-80 characters).
Web-to-Lead is intentionally public and unauthenticated, so an attacker's ability to probe field character limits and general agent behavior is very hard to eliminate; the realistic control is not hiding this reconnaissance surface but hardening what happens downstream once a crafted submission arrives (see Stages 3 and 6).
analyzing Salesforce's Content Security Policy for Agentforce/Einstein, the researchers found that the whitelisted domain my-salesforce-cms.com had lapsed, and purchased it for approximately $5, gaining control of a hostname the AI platform still implicitly trusted for outbound content, a pattern consistent with the broader tactic of acquiring expired-but-trusted infrastructure (look-alike or previously-vetted domain resale) that other supply-chain-style attacks also rely on.
organizations and vendors should inventory and expiry-monitor every domain ever added to an AI system's CSP or trusted-URL allowlist so lapsed registrations can be renewed or removed before anyone else can buy them; Salesforce's actual fix, Trusted URL Allowlisting enforced from September 8, 2025, also closes this specific channel: a link that is not on the org's trusted URL list is blocked from the agent conversation and replaced with "URL_Redacted," regardless of whether that domain was ever legitimately whitelisted before.
the researchers, in the attacker role, authored a multi-step prompt disguised as ordinary lead data (harmless-looking questions followed by instructions to enumerate CRM lead/contact emails and embed them, URL-encoded, in an HTML image-tag request to the attacker-controlled domain), designed so an LLM reading it as "data" would instead execute it as "instructions."
input validation and prompt-injection detection on free-text fields (flagging unusually long or instruction-shaped submissions, a control Noma itself recommended) can catch a crafted multi-step payload before it is ever stored as a normal-looking lead record.
the poisoned lead was submitted through Salesforce's Web-to-Lead form, a standard public marketing-site intake form that requires no authentication and no interaction with any human at submission time. In this research the receiving org was the one Noma had configured itself, so there was no target organization.
standard public-form defenses such as spam/anomaly filtering and content-length or pattern review on inbound Web-to-Lead submissions can flag suspicious entries at intake, though this is a soft control since legitimate leads can also include long free-text descriptions.
the malicious lead record sat inertly in the researchers' own Salesforce org as ordinary-looking business data, exactly like any other inbound sales lead, until an agent later read it, the defining trait of an indirect/stored prompt injection.
periodic automated auditing of stored CRM free-text fields for injection-like patterns, another practice Noma explicitly recommended, can identify and quarantine a poisoned record while it is still dormant, before any employee or agent ever queries it.
no employee was involved at any point. Noma developed what it headed "Realistic Employee Interaction Development" and ran the query itself, a scripted stand-in asking the agent to check a lead filed under an invented name and answer its questions, which pulled the poisoned Description into the agent's context window, where it could not distinguish attacker-authored instructions from trusted business data.
treating all agent-ingested third-party data (lead descriptions, ticket bodies, form submissions) as untrusted input, and architecting agents with a context-sanitization or mediation layer that structurally separates operator instructions from retrieved data, reduces the chance an LLM executes commands embedded inside a CRM record it was merely asked to summarize.
the agent carried out the embedded instructions, compiled CRM lead and contact data, and emitted an HTML image tag pointing at the researcher-owned domain with that data appended as URL parameters; the browser rendering the agent's reply then requested the "image," which delivered the data to the logging server the researchers ran on Amazon Lightsail and completed the proof of concept.
Salesforce's Trusted URL Allowlisting enforcement is the direct control here, stripping any non-approved URL out of the agent's reply before a browser can request it; combined with constraining agent network/tool egress to a strict allowlist and requiring human-reviewable output before agents act on untrusted records, this stops the covert exfiltration from reaching attacker infrastructure even if earlier stages are not caught.
Browse by what this case has in common with others in the library.
ESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
OpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool.…
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push…
In 2015, fake emails from Ubiquiti's CEO and a real London lawyer got its finance chief to wire $46.7M. How…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
The SEC's 2018 Section 21(a) report detailed how fake-executive and fake-vendor BEC emails caused nearly $100 million in combined losses…
Researchers from UIUC, the University of Michigan, and Google dropped 297 USB drives across the UIUC campus and found that…
OpenAI's own test agents escaped their sandbox and broke into Hugging Face in July 2026, chasing a grader that didn't…
A job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What…
Anthropic says a UK cybercriminal used Claude to build ransomware they couldn't write alone, then sold kits for $400 to…
Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
Attackers made Microsoft's own Azure Monitor send a fake $459.90 Windows Defender bill that passed SPF, DKIM and DMARC. A…
An Austin man lost $1,408,850 to a fake DAIQ crypto platform found on LINE. A staged $40,000 handoff led police…
TV investigative reporters filmed Rite Aid pharmacy dumpsters nationwide overflowing with readable prescription labels.
OpenAI's own test agents escaped their sandbox and broke into Hugging Face in July 2026, chasing a grader that didn't…
The FTC warned in 2023 about fake QR codes on parking meters and in texts. What it said, the Texas…
A phishing email tricked Unatrac's CFO into surrendering his Office365 credentials on a fake Microsoft login page; the attacker then…
A Rapid7 penetration tester tailgated into a client's building using door-holding reciprocity and a cloned-looking badge, rode an elevator up…
Researchers from UIUC, the University of Michigan, and Google dropped 297 USB drives across the UIUC campus and found that…
Three separate congressional watchdog engagements, not one campaign. In 2000, GAO agents carrying counterfeit badges declared themselves armed officers and…
Imperva hid prompt injections behind whitespace in contact names, vCards and WhatsApp pins, making an OpenClaw agent run a script.…
ESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be…
Social Engineering Examples