Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection

Salesforce has patched a critical flaw, codenamed ForcedLeak, that allows potential exfiltration of sensitive data from its Agentforce CRM AI tool via an indirect prompt injection. Discovered by Noma Security, the vulnerability has a CVSS score of 9.4 and affects organisations using Salesforce Agentforce with Web-to-Lead enabled.

The exploit can coerce the Description field in a Web-to-Lead submission to run malicious instructions, enabling a threat actor to leak data to an attacker‑controlled domain that had expired and become purchasable for around $5, before Salesforce re-secured it. The fix prevents output in Agentforce and Einstein AI agents from being sent to untrusted URLs by enforcing a URL allowlist, with Salesforce stating that trusted URLs will be enforced to stop external requests after a prompt injection.

The Hacker News notes the discovery was reported on 28 July 2025 and that the company encouraged auditing lead data, validating inputs, and sanitising data from untrusted sources as part of the mitigation. According to The Hacker News.