Experts disclosed a critical flaw, named ForcedLeak, in Salesforce Agentforce that enables indirect prompt injection, risking data exposure

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Yet again researchers have uncovered an opportunity (dubbed "ForcedLeak" for indirect prompt injection against autonomous agents lacking sufficient security controls — but this time the risk involves PII, corporate secrets, physical location data, and so much more.

ForcedLeak reveals how attackers exploited Salesforce AgentForce using prompt injection, exposing sensitive CRM data.

Experts disclosed a critical flaw, named ForcedLeak, in Salesforce Agentforce that enables indirect prompt injection, risking data exposure

Blog personal de Chema Alonso ( https://MyPublicInbox.com/ChemaAlonso ): Ciberseguridad, IA, Innovación, Tecnología, Cómics & Cosas Personasles.

Researchers uncovered a security flaw in Salesforce’s shiny new Agentforce. The vulnerability, dubbed "ForcedLeak", let them smuggle AI-read instructions in via humble Web-to-Lead form... and ended up...

ForcedLeak flaw in Salesforce Agentforce allows data exfiltration via indirect prompt injection; Salesforce issues patch.

The ForcedLeak AI agent vulnerability raises the question, "What is the difference between AI prompt injection and XXS vulnerabilities?"

Prompt injection has been leveraged alongside an expired domain to steal Salesforce data in an attack named ForcedLeak.

Researchers uncovered a security flaw in Salesforce’s shiny new Agentforce. The vulnerability, dubbed “ForcedLeak”, let them smuggle AI-read instructions in via humble Web-to-Lead form… and ended up spilling data for the low, low price of five dollars. And we discuss why data breach communicationss still default to “we take security seriously” while quietly implying “assume no breach” – until the inevitable walk-back.

Researchers discovered a critical vulnerability called ForcedLeak (CVE-pending) in Salesforce Agentforce that allows attackers to exploit AI agents through indirect prompt injection attacks via Web-to...

The ForcedLeak vulnerability, a critical flaw in Salesforce Agentforce, allowed for data exfiltration via AI prompt injection attacks.

The ForcedLeak vulnerability, a critical flaw in Salesforce Agentforce, allowed for data exfiltration via AI prompt injection attacks.

Uma vulnerabilidade de segurança crítica no sistema Agentforce da Salesforce expôs informações confidenciais de clientes da companhia, conforme revelou a Noma Security na quinta-feira (25). Ela **permitia que invasores roubassem esses conteúdos por meio de injeção indireta de prompt**. Denominada “ForcedLeak”, a falha mostra como ferramentas de negócios integradas a soluções de inteligência artificial sem supervisão humana podem ser usadas indevidamente para a coleta de dados, de acordo com a empresa de segurança cibernética que descobriu o problema. Não se sabe se a brecha foi explorada em ataques. A falha afetava a plataforma AgentForce. (Imagem: Salesforce/Divulgação) ## Instruções maliciosas para agentes de IA O recurso Agentforce é uma plataforma de agentes de inteligência artificial, bots com capacidade de realizar atividades de maneira autônoma. Segundo o relatório, cibercriminosos poderiam aproveitar a solução para acessar dados de usuários a partir de prompts maliciosos ou permissões mal configuradas. * Para tanto, **invasores usariam formulários da plataforma para enviar instruções aos agentes, escondidas em meio a dados que a IA já processa normalmente** ; * Ao ler solicitações feitas por clientes legítimos, o sistema também analisaria os pedidos maliciosos incorporados, sem distingui-los dos demais, realizando a tarefa desejada; * Em um teste feito por pesquisadores da Noma, a IA enviou endereços de email de clientes para um servidor externo, obedecendo as instruções e confirmando o sucesso do ataque; * Os especialistas disseram que, em uma campanha real, seria possível coletar diversos dados sigilosos de terceiros, incluindo contratos, relatórios de venda, estratégias de negócios, comunicações internas e muito mais. A operação envolvia, ainda, a utilização de um domínio considerado “confiável” pela Salesforce, para o qual os dados extraviados foram enviados. Curiosamente, ele estava expirado e à venda por apenas US$ 5, o equivalente a R$ 26,70 pela cotação do dia, valor pago pelos pesquisadores. Qualquer empresa que utilizasse o Agentforce com os formulários Web-toLead habilitado, principalmente para vendas, marketing e aquisição de clientes, era uma vítima em potencial. A exploração da vulnerabilidade ForcedLeak poderia trazer sérios impactos para os alvos, segundo o estudo. Os agentes de IA são bots com capacidade autônoma. (Imagem: Getty Images) ## Correções implementadas Alertada em julho sobre a falha na plataforma Agentforce, a Salesforce implementou as correções necessárias no início de setembro. Entre elas, a empresa lançou **patches que impedem o envio de dados pelos agentes de IA para endereços não confiáveis**. “O cenário de segurança para injeção imediata continua sendo uma área complexa e em evolução, e continuamos a investir em fortes controles de segurança e trabalhar em estreita colaboração com a comunidade de pesquisa para ajudar a proteger nossos clientes à medida que esses tipos de problemas surgem”, ressaltou a companhia, em comunicado ao site _Hackread_. Fornecedora de milhares de organizações em todo o mundo, a Salesforce foi alvo de um incidente de segurança recentemente, chatbot usado para vendas e engajamento. A violação atingiu grandes clientes da marca, como Google, Adidas, Allianz Life e Palo Alto Networks, cujas informações acabaram vazando. Gostou do conteúdo? Siga no TecMundo para mais atualizações sobre cibersegurança e compartilhe as notícias nas redes sociais.

Researchers uncovered a security flaw in Salesforce’s shiny new Agentforce. The vulnerability, dubbed “ForcedLeak”, let them smuggle AI-read instructions in via humble Web-to-Lead form… and ended up spilling data for the low, low price of five dollars. And we discuss why data breach communicationss still default to “we take security seriously” while quietly implying “assume no breach” – until the inevitable walk-back.

A newly disclosed critical vulnerability in Salesforce’s Agentforce platform could trick the AI agent into leaking sensitive CRM data through indirect prompt injection. Researchers at Noma Security, who identified the bug dubbed “ForcedLeak,” said in a blog post shared with CSO ahead of its publication on Thursday that it could be exploited by attackers inserting malicious instructions into a routine customer form. Salesforce patched the issue after disclosure, but Noma researchers believe the implications go well beyond one bug. ## From innocent Form to full-on data heist The attack path revealed by Noma was deceptively simple. By planting malicious text inside Salesforce’s Web-to-Lead form, commonly used in marketing campaigns, researchers found that an AI agent (Agentforce) tasked with reviewing submissions could be coaxed into running instructions it was never meant to. The description field, with its 42000-character allowance, provided enough space to hide multi-step payloads disguised as harmless business requests. Once an employee interacts with the data and asks Agentforce to process it, the system obediently carries out both the real request and the attacker’s hidden script. Worse, Salesforce’s content security policy included an expired domain still on its whitelist. By re-registering the domain for just $5, researchers created a trusted-looking data exfiltration channel, turning a minor oversight into a major security hole. “Indirect Prompt Injection is basically cross-site scripting, but instead of tricking a database, attackers get inline AI to do it,” said Andy Bennet, CISO at Apollo Information Systems. “It’s like a mix of scripted attacks and social engineering. The innovation is impressive and the impacts are potentially staggering.” Salesforce apparently patched this CVE-pending flaw on September 8, 2025, by enforcing “Trusted URL allowlists” for Agentforce. While the company did not directly credit Noma for the finding, it included a related description. “Our underlying services powering Agentforce will enforce the Trusted URL allowlist to ensure no malicious links are called or generated through potential prompt injection,” it had said. Salesforce did not immediately respond to a CSO’s request for comment on Noma’s disclosure. ## Guardrails, not just patches While Salesforce responded quickly with a patch, experts agree that AI agents represent a fundamentally broader attack surface. These systems combine memory, decision-making, and tool execution, meaning compromises can spread quickly and, as Bennet puts it, “at machine speed.” “It’s advisable to secure the systems around the AI agents in use, which include APIs, forms, and middleware, so that prompt injection is harder to exploit and less harmful if it succeeds,” said Chrissa Constantine, senior cybersecurity solution architect at Black Duck. She emphasized that true prevention requires not just patching but “maintaining configuration and establishing guardrails around the agent design, software supply chain, web application, and API testing.” Noma’s researchers echoed that call, urging organizations to treat AI agents like production systems, inventorying every agent, validating outbound connections, sanitizing inputs before they reach the model, and flagging any sensitive data access or internet egress. Sanitize external input before the agent sees it, suggested Elad Luz, head of research at Oasis Security. “Treat free-text from contact forms as untrusted input. Use an input mediation layer to extract only expected fields, strip/neutralize instructions, links, and markup, and prevent the model from interpreting user content as commands (prompt-injection resilience).” 1.