Salesforce AI Agent Vulnerability Lets Attackers Steal Sensitive Data

Cybersecurity researchers at Noma Labs have identified a critical vulnerability in Salesforce's Agentforce AI platform. This vulnerability, named "ForcedLeak," could potentially allow attackers to access sensitive customer data using advanced prompt injection techniques.

The ForcedLeak vulnerability has been assigned a CVSS score of 9.4, indicating a high severity level.

The vulnerability exploits Salesforce's Web-to-Lead functionality, a feature typically used in conferences and marketing campaigns to gather prospect information. Attackers can insert malicious instructions within seemingly legitimate lead submissions, which execute when employees query the AI system about that data.

Agentforce functions as an autonomous AI agent capable of reasoning, planning, and executing complex business tasks. This expanded functionality increases the attack surface, encompassing knowledge bases, executable tools, internal memory, and connected systems.

The attack utilizes indirect prompt injection, where malicious instructions are embedded in data processed by the AI at a later stage. Routine queries from employees about lead information can inadvertently trigger the execution of these hidden malicious commands.

Researchers identified the Description field in the Web-to-Lead form as a prime injection point, due to its 42,000-character limit, which allows for complex, multi-step instruction sets.

The attack was successful due to the exploitation of three critical weaknesses:

Context validation failures that permitted the AI to process requests outside its intended domain. Overly permissive AI model behavior that could not differentiate between legitimate data and malicious instructions. Content Security Policy bypass through an expired whitelisted domain (my-salesforce-cms.com).

The expired domain was crucial for data exfiltration, as it retained trusted status while being under potential malicious control. Organizations using Salesforce Agentforce with Web-to-Lead functionality are at significant risk, particularly those involved in sales, marketing, and customer acquisition workflows.

Successful exploitation could lead to exposure of customer contact information, sales pipeline data, internal communications, and historical interaction records.

Upon notification in July 2025, Salesforce conducted an immediate investigation and released patches in September 2025. The company implemented Trusted URLs Enforcement for Agentforce and Einstein AI to prevent output transmission to untrusted URLs and re-secured the expired whitelist domain.

Organizations are advised to apply Salesforce's recommended security updates promptly to enforce Trusted URLs for Agentforce. Additional protective measures include auditing existing lead data for suspicious submissions, implementing strict input validation, and sanitizing data from untrusted sources.

This vulnerability underscores how AI agents present unique security challenges, necessitating new approaches to threat modeling and security controls in AI-integrated business environments.

Based on reporting by GBHackers.