Salesforce AI Hack Enabled CRM Data Theft

Salesforce has disclosed a prompt injection attack dubbed ForcedLeak that exploited an expired domain to target its Agentforce platform and exfiltrate CRM data. According to SecurityWeek, the method used with Agentforce’s Web-to-Lead functionality allowed attackers to submit specially crafted information via a web form, prompting autonomous AI agents to perform actions on the attacker’s behalf and collect email addresses into a remote server’s parameters.

The researchers demonstrated the risk by submitting a payload that instructed the AI to gather data and send it to an external server, with data stored in the CRM subsequently being exfiltrated. The attack appeared likely to remain undetected because a trusted Salesforce domain had been left to expire, potentially enabling an attacker to register it for the data-receiving server.

After notification, Salesforce regained control of the domain and implemented changes to prevent AI agent output from being sent to untrusted domains. Written by Eduard Kovacs and published on 25 September 2025.