ForcedLeak flaw in Salesforce Agentforce exposes CRM data via Prompt Injection

Researchers have disclosed a critical vulnerability named ForcedLeak in Salesforce Agentforce that enables indirect prompt injection and could lead to CRM data exposure. The flaw, rated CVSS 9.4, affects organisations using Salesforce Agentforce with Web-to-Lead enabled, and arises from weaknesses in context validation, overly permissive AI model behaviour, and a CSP bypass.

According to Noma Labs, attackers can craft malicious Web-to-Lead submissions that cause the AI to execute unauthorised commands when processed by Agentforce, with the LLM acting as a simple execution engine unable to distinguish legitimate data from malicious instructions.

The Web-to-Lead Description field, at 42,000 characters, was identified as an ideal payload vehicle, and researchers demonstrated how an adversary could exfiltrate CRM data by encoding leads’ email addresses into an image tag that points to an attacker URL.

The disclosure timeline shows public disclosure on 25 September 2025, with Salesforce implementing Trusted URLs Enforcement for Agentforce and Einstein AI on 8 September 2025, after initial reporting on 28 July 2025 and Salesforce acknowledgement on 31 July 2025. Salesforce has since patched the issue and tightened allowlist controls.