Case forcedleak-agentforcePrompt injectionUnited States
ForcedLeak: Web-to-Lead prompt injection and a $5 expired domain leak Agentforce CRM data
Noma Security found instructions in a Web-to-Lead form, plus a whitelisted Salesforce CSP domain that had expired and cost $5, let Agentforce send CRM records to an attacker. Salesforce fixed it by 8 September 2025.
CriticalAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 25, 2025
- Location
- United States
- Target
- Salesforce Agentforce
- Severity
- Critical
- Triggered by
- Noma Labs (Noma Security)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Noma Security found instructions in a Web-to-Lead form, plus a whitelisted Salesforce CSP domain that had expired and cost $5, let Agentforce send CRM records to an attacker. Salesforce fixed it by 8 September 2025.
Impact: Any organisation using Agentforce with Web-to-Lead was exposed to CRM exfiltration; no confirmed abuse
Who triggered it
Actor: Noma Labs (Noma Security)
Attribution: Responsible disclosure to Salesforce on 28 July 2025; Noma scored it CVSS 9.4
Motive: Security research
How it happened
Attack vector: Hidden instructions in the Description field of a Web-to-Lead submission; when staff query leads, the agent renders a PNG request carrying CRM data to the expired my-salesforce-cms.com domain
Root cause: Agent could not distinguish data from instructions, and the Content Security Policy trusted a domain Salesforce no longer owned
Timeline
- Noma reports ForcedLeak to Salesforce
- Salesforce deploys Trusted URL enforcement for Agentforce and Einstein
- Public disclosure
Response
Salesforce re-registered the expired domain and enforced Trusted URLs so agents cannot send data to untrusted destinations
Current status: Patched
Sources (open in a new tab)
- The Hacker News thehackernews.com
- Dark Reading darkreading.com
- Security Affairs securityaffairs.com
Cite this case
ForcedLeak: Web-to-Lead prompt injection and a $5 expired domain leak Agentforce CRM data. AI Threat Watch, case forcedleak-agentforce, Sep 25, 2025. https://aithreat.io/cases/forcedleak-agentforce/
Permanent link: https://aithreat.io/cases/forcedleak-agentforce/