ForcedLeak: CRM Data Exfiltration from Salesforce Agentforce
Malicious instructions embedded in a Web-to-Lead submission were later executed by Salesforce Agentforce during normal employee use, exfiltrating CRM data through an attacker-acquired domain still on Salesforce's CSP allowlist — bought for $5.
What happened
Noma Labs disclosed ForcedLeak (CVSS 9.4) in September 2025 — an indirect prompt injection chain in Salesforce Agentforce. An external attacker submits a Web-to-Lead form (a normal, public intake path) with malicious instructions hidden in a free-text field. Later, when an employee has Agentforce process that lead, the agent executes the planted instructions as if they were legitimate.
To get the stolen CRM data out, the researchers exploited a Content-Security-Policy allowlist weakness: an expired domain that had previously been trusted was still on Salesforce’s allowlist and could be re-registered for $5. Data exposure spanned customer PII, contact details, and sales-pipeline information. Salesforce responded by enforcing Trusted URLs for Agentforce/Einstein and re-securing the lapsed domain.
Why it maps to ATLAS
- AML.T0051.001 — LLM Prompt Injection: Indirect: the payload rides in CRM data the agent consumes, not a direct prompt.
- AML.T0093 — Prompt Infiltration via Public-Facing Application: the Web-to-Lead form is the public entry point.
- AML.T0086 — Exfiltration via AI Agent Tool Invocation: the agent’s own actions carry data out to the attacker domain.
- AML.T0048.003 — External Harms: User Harm: exposure of customer PII and sales data.
Detection notes
Any agent that ingests untrusted, externally-writable fields (leads, cases, tickets) inherits their trust boundary. Alert on instruction-like text in intake fields, on agents reading records far beyond the task at hand, and on egress to freshly-registered or recently-expired allowlisted domains — allowlists are only as good as their expiry hygiene.
Detection
Log sources
- Agentforce action / tool-invocation logs
- CRM record access + export audit
- Outbound URL egress from the agent runtime
Signals
- Lead/case free-text fields containing instructions to the agent
- Agent bulk-reading CRM records outside the task scope
- Egress to newly-registered or recently-expired allowlisted domains
Mitigations
- Sanitize untrusted CRM free-text before it enters agent context
- Enforce strict, actively-audited Trusted URL allowlists (no expired domains)
- Least-privilege tools; approval gates on bulk read/export actions