ForcedLeak: Indirect Prompt Injection Exfiltrates Salesforce Agentforce CRM Data via Web-to-Lead Form and Expired CSP-Whitelisted Domain

What Happened

In mid-2025, researchers at Noma Security (lead researcher Sasi Levi) discovered and demonstrated "ForcedLeak," a critical (CVSS v4.0 9.4) vulnerability chain in Salesforce's Agentforce AI agent platform (and Einstein AI). The proof-of-concept showed that an external, unauthenticated attacker could submit a Salesforce Web-to-Lead form (a standard public lead-capture form many companies embed on marketing sites) with a hidden multi-step instruction payload stuffed into the Description field, which permits up to 42,000 characters. The malicious lead then sat dormant in the CRM as ordinary-looking data. When a legitimate employee later used Agentforce to ask a routine question about that lead, the AI agent ingested the poisoned Description text as part of its context and, unable to distinguish attacker-supplied instructions from trusted business data, executed the embedded commands. Those commands directed the agent to gather CRM lead/contact data and exfiltrate it via an HTML image-tag request to my-salesforce-cms.com, a domain that had previously been legitimately whitelisted in Salesforce's Content Security Policy for Agentforce/Einstein but whose registration had since lapsed. Noma researchers purchased the expired domain for roughly $5, giving them control of infrastructure the AI stack still implicitly trusted, and used it as the exfiltration endpoint in their PoC (capturing data such as lead email addresses via URL parameters). Noma reported the issue to Salesforce on July 28, 2025; Salesforce acknowledged it on July 31, 2025; Salesforce rolled out a fix, Trusted URL Allowlisting enforcement for Agentforce and Einstein AI, on September 8, 2025, and separately re-secured the lapsed domain; Noma publicly disclosed full technical details on September 25, 2025, after the mitigation was live.

How the Attack Worked

Salesforce Agentforce (and Einstein AI) agents are designed to be queried by employees about CRM records, including inbound sales leads captured through the public, unauthenticated Web-to-Lead web form. Noma researchers found that the lead-capture form's "Description" field accepts up to 42,000 characters with no sanitization for instruction-like content. They crafted a lead submission whose Description field contained a multi-step hidden prompt: instructions written to look like data but actually directing an LLM to search for and compile sensitive CRM information (e.g., other lead/contact details, case data) and then exfiltrate it. Because the lead sits inertly in Salesforce until a human or agent interacts with it, this is an indirect/stored prompt injection: the attacker never talks to the AI directly. The trigger occurred later, when a legitimate employee, doing normal sales-ops work, asked Agentforce a routine question about that lead. The agent pulled the lead record into its context window, could not distinguish attacker-authored "data" from operator-authored "instructions," and executed the embedded steps. For the exfiltration channel, Noma discovered that Salesforce's Content Security Policy for Agentforce/Einstein still trusted an old vendor domain, my-salesforce-cms.com, whose registration had lapsed. Noma bought the expired domain for about $5, regaining full control of a hostname the CRM's AI stack still implicitly trusted for outbound content. The injected instructions caused the agent to render/request an HTML image tag pointing at that now-attacker-owned domain, with sensitive CRM data (e.g., lead email addresses, URL-encoded with %20 for spaces) appended as URL parameters, so the mere act of the browser/agent loading the "image" transmitted the data to the attacker's server logs, an exfiltration technique that requires no script execution and slips past CSPs that only vet the domain, not the payload.

The Lure & the Tell

The "lure" was structural rather than a phishing message: the Web-to-Lead form is an intentionally public, unauthenticated entry point (used on marketing sites to capture inbound sales interest), so submitting a poisoned lead required no social engineering of a human at all; it only had to look like a plausible enough lead submission to avoid spam/validation filters, while the 42,000-character Description field gave more than enough room to hide a full instruction set. There was no human "tell" to notice because no human read the payload; the deception target was the AI agent itself; when an employee later asked Agentforce something ordinary like "summarize this lead" or "what does this contact want," the employee saw only normal-looking agent behavior, not an overt anomaly, since the CSP-domain and image-tag technique had no visible UI symptom. The closest thing to a detectable tell, for a defender who knew to look, would be an unusually long/instruction-shaped Description field on an inbound lead, or unexpected outbound requests to a domain no longer under legitimate vendor control.

Outcome

No confirmed customer data breach or financial loss was publicly attributed to malicious exploitation; this was a responsibly disclosed research finding (a "ForcedLeak" proof-of-concept), not a reported real-world attack campaign, per all cited sources. Noma reported the flaw to Salesforce on 2025-07-28; Salesforce acknowledged on 2025-07-31; Salesforce rolled out Trusted URL Allowlisting enforcement for Agentforce and Einstein AI on 2025-09-08, blocking agents from sending output to non-approved external URLs; Salesforce also re-secured the lapsed my-salesforce-cms.com domain. Noma publicly disclosed the full technical writeup on 2025-09-25 after the fix was live. Salesforce stated it had released patches and did not confirm whether any customer was actually affected before the mitigation.

Why It Matters

ForcedLeak is a textbook illustration of the "lethal trifecta" risk pattern in enterprise AI agents: (1) access to untrusted external input (a public web form anyone can submit to), (2) access to sensitive private data (the full CRM), and (3) an externally-reachable communication channel the agent can be tricked into using (rendering images/links to arbitrary allowlisted domains). None of Salesforce's traditional web-app defenses (CSP, input validation on a free-text field, form spam filters) were designed to stop an LLM from treating ingested data as executable instructions, so the attack slipped through gaps between classic AppSec and AI-agent security. It also spotlights an overlooked, transferable class of risk: any domain ever added to an AI system's trusted-origin/CSP allowlist becomes a standing liability if its registration is allowed to lapse, since anyone can buy it and inherit that trust, a concrete, cheap ($5) real-world instance of "expired trust as an attack surface." Because Web-to-Lead-style public intake forms and free-text description fields are common integration patterns across many CRMs and SaaS products now being wired into AI agents, the underlying pattern (unauthenticated write access to a field an AI agent will later read and reason over) generalizes well beyond Salesforce, making this a widely cited case study for agentic-AI indirect prompt injection risk.

Defenses

Salesforce's fix was Trusted URL Allowlisting for Agentforce and Einstein AI (enforced from Sept 8, 2025), which blocks agents from generating or following links to/calling non-approved external domains, preventing agent-composed requests from reaching attacker infrastructure regardless of what instructions get injected into agent context. Salesforce also reclaimed/re-secured the lapsed my-salesforce-cms.com domain so it could no longer be re-registered by outsiders. Broader lessons Noma and coverage drew: treat all agent-ingested third-party/CRM free-text fields (lead descriptions, form submissions, ticket bodies) as untrusted input that can carry executable instructions for an LLM; audit and expire-monitor any domains ever added to an AI system's CSP/egress allowlist so they can't be resold to attackers; constrain agent tool/network egress to a strict allowlist rather than trusting default web fetch/image-render capabilities; and require human-reviewable, auditable output channels before agents act on ingested untrusted records. Also relevant: Salesforce's Trust and security-advisories page as the vendor's ongoing disclosure channel for this class of issue.