Prompt Injection Vulnerability in Salesforce AgentForce AI Patched
Cybersecurity researchers discovered a critical prompt injection vulnerability in Salesforce AgentForce that could have allowed attackers to steal CRM data through malicious instructions embedded in Web-to-Lead forms. Salesforce patched the vulnerability by September 2025 by enforcing Trusted URLs and re-securing an expired domain in its Content Security Policy whitelist.
What happened
Noma Labs discovered a critical vulnerability chain in Salesforce AgentForce, dubbed ForcedLeak, with a CVSS severity score of 9.4. Researchers exploited Salesforce's Web-to-Lead feature by injecting malicious instructions into the description field (which has a 42,000 character limit), which were then stored as customer data.
When employees queried AgentForce, the system processed both legitimate requests and hidden malicious commands embedded in the Web-to-Lead form data. Attackers could also purchase an expired domain in Salesforce's Content Security Policy whitelist to exfiltrate CRM data.
Reported impact
The vulnerability could have allowed attackers to steal sensitive CRM data through indirect prompt injection, including customer contact information, sales pipeline details, and internal communications.
Index analysis
AgentForce operates with autonomy and can plan, execute, and respond based on multiple inputs without human oversight, expanding the attack surface compared to traditional chatbots. Indirect prompt injection operates similarly to cross-site scripting but tricks AI systems into performing unintended actions rather than databases.
Governance controls
Salesforce patched the issue by September 8, 2025 by enforcing Trusted URLs for AgentForce and re-securing the expired domain. The company recommended that organizations using AgentForce with Web-to-Lead enabled apply patches immediately, audit existing lead data for suspicious submissions, and enforce strict tool-calling security guardrails.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.