TLDR: A critical vulnerability, dubbed ‘ForcedLeak’ (CVSS 9.4), has been discovered in Salesforce’s AI-powered AgentForce platform. Identified by Noma Security, the flaw allowed attackers to exfiltrate sensitive CRM data through indirect prompt injection. Salesforce has since patched the issue by enforcing Trusted URLs and re-securing an expired domain.
Cybersecurity researchers have unveiled a critical vulnerability, named ‘ForcedLeak,’ within Salesforce’s AI-powered AgentForce platform, a system designed to manage complex business tasks within CRM environments. The flaw, assigned a CVSS score of 9.4, could have enabled external attackers to steal sensitive customer relationship management (CRM) data through a sophisticated indirect prompt injection attack. Noma Security, the firm that discovered and reported the vulnerability on July 28, 2025, highlighted that Salesforce acted swiftly, releasing patches by September 8, 2025, to mitigate the risk.
The ‘ForcedLeak’ vulnerability demonstrates a new frontier in cyber threats, showcasing how AI agents present a ‘fundamentally different and expanded attack surface compared to traditional prompt-response systems,’ according to Sasi Levi, security research lead at Noma. Unlike conventional prompt-response systems, AI agents like AgentForce operate with a degree of autonomy, capable of planning, executing, and responding based on multiple inputs without direct human oversight. This expanded capability, however, also introduces new vectors for exploitation.
Attackers exploited weaknesses in context validation, overly permissive AI model behavior, and a Content Security Policy (CSP) bypass. The method involved embedding malicious instructions within trusted data sources, such as Salesforce’s Web-to-Lead forms. These malicious commands would then be executed when legitimate users or employees interacted with AgentForce, leading to unauthorized data exfiltration. Andy Bennett, CISO at Apollo Information Systems, likened indirect prompt injection to ‘cross-site scripting, but instead of tricking a database into doing or divulging things it shouldn’t, the attackers get the inline AI to do it. It is like a mix of scripted attacks and social engineering.’
The potential ‘blast radius’ of this vulnerability was significant, enabling possible lateral movement to connected business systems and APIs due to Salesforce’s extensive integrations. The data at risk included customer contact information, sales pipeline data revealing business strategy, internal communications, third-party integration data, and historical interaction records spanning months or years of customer relationships. Furthermore, the research revealed that Salesforce’s Content Security Policy whitelist contained an expired domain, which attackers could have purchased cheaply to serve as an exfiltration point for stolen CRM data.
Also Read:
- World Economic Forum Warns: Unsecured AI Agents Unleash Sophisticated Cyberthreats on Businesses
- Generative AI Tools Linked to Widespread Sensitive Data Exposure in Early 2025
Salesforce’s remediation efforts included enforcing ‘Trusted URLs’ for AgentForce and its Einstein AI, preventing output from being sent to untrusted web addresses, and re-securing the expired domain. The company also advised users to audit existing lead data for unusual submissions. Chrissa Constantine, senior cybersecurity solution architect at Black Duck, emphasized the importance of securing systems surrounding AI agents, including APIs, forms, and middleware, to make prompt injection harder to exploit and less harmful if successful.
