Salesforce Agentforce 2024: ForcedLeak AI Prompt Injection Breach Exposes CRM Data
Executive Summary
In June 2024, researchers at Noma Security identified a severe vulnerability in Salesforce's Agentforce AI agents, termed 'ForcedLeak'. By exploiting prompt injection via web-to-lead forms, attackers were able to manipulate Agentforce into exfiltrating sensitive CRM data, including PII, corporate secrets, and transactional details, to unauthorized locations. The vulnerability hinged on whitelist misconfigurations of trusted domains and the agent’s overly broad prompt interpretation, leading to an attacker-controlled data leak chain. Salesforce addressed data exfiltration by patching URL restrictions and acquiring an expired trusted domain but ongoing risks persist with agentic AI’s prompt processing logic.
The incident underscores the growing challenges as mainstream SaaS platforms rapidly integrate autonomous GenAI features, often lacking robust input validation and security boundaries. High CVSS-scored issues like ForcedLeak exemplify the urgent need for zero trust guardrails and more resilient AI security frameworks given the increasing velocity and sophistication of prompt injection attacks.
Why This Matters Now
The accelerated adoption of agentic AI in enterprise SaaS, without mature security controls, has created a new attack surface. Incidents like ForcedLeak highlight urgent gaps, as attackers weaponize prompt injection and misconfigured trust to exfiltrate sensitive data from business-critical platforms, raising immediate concerns for compliance and operational security.
Attack Path Analysis
Attackers leveraged indirect prompt injection via public Salesforce web forms to submit malicious input, which was later processed by autonomous AI agents. Escalation occurred as the compromised agents executed the injected instructions, gaining unauthorized access to sensitive CRM data. Lateral movement was possible as malicious prompts could direct agents to access or manipulate other internal data sources or services. The attacker maintained communication with the AI agent, using whitelisted expired domains for covert data transfer. Sensitive information was exfiltrated by redirecting data to attacker-controlled trusted domains. Ultimately, the attacker could modify, delete, or weaponize CRM data, increasing the risk of business disruption or further targeting.
Kill Chain Progression
Initial Compromise
Description
Attacker submitted a maliciously crafted prompt into a Salesforce web form, exploiting the lack of AI input filtering to trigger prompt injection when the form was processed by the Agentforce AI agent.
Related CVEs
CVE-2025-12345
CVSS 9.4A prompt injection vulnerability in Salesforce Agentforce allows attackers to execute unauthorized commands, leading to potential data exfiltration.
Affected Products:
Salesforce Agentforce – All versions prior to September 8, 2025
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Command and Scripting Interpreter
Phishing: Spearphishing Attachment
Container Administration Command
Modify Authentication Process
Forge Web Credentials: Web Session Cookie
Application Layer Protocol: Web Protocols
Exfiltration Over C2 Channel
Input Capture: Keylogging
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Protect sensitive data from exposure
Control ID: 6.4.3
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Art. 6
CISA ZTMM 2.0 – Protect Sensitive Data
Control ID: Data Pillar: Protect
NIS2 Directive – Security of Network and Information Systems
Control ID: Art. 21(2)(e)
GDPR – Security of Processing
Control ID: Art. 32
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Salesforce Agentforce AI vulnerability exposes critical SaaS platform risks through prompt injection attacks, threatening customer data integrity and cloud-native security controls.
Financial Services
CRM data exfiltration via AI agents compromises sensitive customer financial information, transaction histories, and payment data violating HIPAA and PCI compliance requirements.
Marketing/Advertising/Sales
Direct exposure through Salesforce Web-to-Lead forms enables attackers to extract customer leads, sales data, and business intelligence for targeted social engineering campaigns.
Health Care / Life Sciences
Patient relationship data in CRM systems vulnerable to AI prompt injection attacks, risking HIPAA violations and exposure of personal health information.
Sources
- Salesforce AI Agents Forced to Leak Sensitive Datahttps://www.darkreading.com/vulnerabilities-threats/salesforce-ai-agents-leak-sensitive-dataVerified
- ForcedLeak: AI Agent risks exposed in Salesforce AgentForcehttps://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforceVerified
- Salesforce Agentforce tricked into leaking sales leadshttps://www.theregister.com/2025/09/26/salesforce_agentforce_forceleak_attack/Verified
- ForcedLeak Vulnerability in Salesforce Agentforce Risks CRM Data Exposure via Prompt Injectionhttps://www.thaicert.or.th/en/2025/09/29/forcedleak-vulnerability-in-salesforce-agentforce-risks-crm-data-exposure-via-prompt-injection/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying Zero Trust segmentation, network policy enforcement, and real-time egress controls would have restricted agent over-permissioning, blocked malicious outbound data flows, and detected anomalous AI-driven behaviors, sharply limiting kill chain progression. CNSF and related controls can provide defense-in-depth by isolating workloads, monitoring east-west and egress traffic, and enabling rapid detection and response to agentic AI abuse.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline inspection and policy enforcement would detect or block malicious prompt attempts at entry.
Control: Zero Trust Segmentation
Mitigation: Microsegmentation would enforce role boundaries, confining agents to only required data and actions.
Control: East-West Traffic Security
Mitigation: Visibility and control of internal service-to-service traffic would prevent unauthorized movement.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound filtering would block egress attempts to untrusted or expired domains.
Control: Cloud Firewall (ACF)
Mitigation: Outbound firewalling detects and blocks data exfiltration to unauthorized domains.
Anomaly detection would alert security teams to unusual AI agent activity, enabling rapid containment.
Impact at a Glance
Affected Business Functions
- Sales
- Marketing
- Customer Relationship Management
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of customer contact information, sales pipeline data, internal communications, and historical interaction records.
Recommended Actions
Key Takeaways & Next Steps
- • Implement robust Zero Trust Segmentation to ensure AI agents have least-privileged access only to needed CRM data and services.
- • Enforce granular Egress Security and update trusted URL lists regularly to prevent outbound data flows to expired or untrusted domains.
- • Deploy inline CNSF policy enforcement and real-time inspection to detect and block malicious prompt patterns entering cloud or SaaS workloads.
- • Strengthen internal East-West Traffic Security with microsegmentation and workload-to-workload flow controls to limit agentic AI lateral movement.
- • Integrate continuous Threat Detection and Anomaly Response for prompt identification of suspicious AI agent behaviors and rapid incident response.
