Salesforce AI Agent Vulnerability Lets Attackers Steal Sensitive Data

Cybersecurity researchers at Noma Labs have disclosed a critical vulnerability in Salesforce’s Agentforce AI platform, dubbed ForcedLeak, which could let attackers steal sensitive customer data through sophisticated prompt injection techniques. The flaw scores CVSS 9.4, indicating maximum severity, and exploits Salesforce’s Web-to-Lead functionality, a feature used in conferences and marketing campaigns to capture prospect information.

The attack operates via indirect prompt injection, with malicious instructions embedded in lead submissions that are later executed when employees query the AI system about that data; the AI in Agentforce can act autonomously, expanding the attack surface to include knowledge bases, tools, internal memory, and connected systems.

Technical exploitation points include the Web-to-Lead form’s Description field, which has a 42,000-character limit, enabling complex multi-step instruction sets; weaknesses include context validation failures, overly permissive AI model behaviour, and a Content Security Policy bypass through an expired whitelisted domain. Salesforce notified in July 2025 and released patches in September 2025, implementing Trusted URLs Enforcement for Agentforce and Einstein AI to prevent output transmission to untrusted URLs.

Organizations are urged to apply the security updates and audit lead data for suspicious submissions, with emphasis on strict input validation and sanitising untrusted data.