Salesforce AI Agents Forced to Leak Sensitive Data

Researchers have uncovered a vulnerability in Salesforce’s Agentforce AI that can cause exfiltration of CRM data via manipulated Web-to-Lead forms, a technique dubbed ForcedLeak for indirect prompt injection. The flaw is described as a cross-site scripting (XSS) play for the AI era, with Agentforce scoring 9.4 out of 10 on the CVSS scale.

In tests conducted by Noma Security, an attacker could embed a malicious prompt in a form, prompting an AI agent to leak internal data, including notes, customer details, and even sales information that could facilitate targeted social engineering. Salesforce has released patches to prevent output from Agentforce agents being sent to untrusted URLs and to tighten trusted URLs rules, though researchers note the root cause remains a complex prompt-filtering challenge.

The researchers warn that such an attack could enable data leakage or broader manipulation of CRM data, and that attackers might pivot from exfiltration to other systems if safeguards fail, according to Salesforce. 25 September 2025.