In September 2025, Noma Security disclosed ForcedLeak, a critical vulnerability chain in Salesforce Agentforce, the platform companies use to run AI agents over their CRM data. An outside attacker could plant instructions in a public Web-to-Lead form. When an employee later asked Agentforce about that lead, the agent followed the hidden instructions, queried other CRM records and sent the results to an external server. The server sat on a domain that Salesforce's own content security policy still trusted, but which had expired and was bought by the researcher for about $5. No attacker login was needed at any stage: the AI agent's own access did the work.
Key takeaways
- Noma Security rated ForcedLeak CVSS 9.4 (critical). It reported the issue on 28 July 2025, Salesforce began enforcing Trusted URLs for Agentforce and Einstein AI on 8 September 2025, and the research was published on 25 September 2025.
- The attack was indirect prompt injection. Instructions hidden in the Description field of a Web-to-Lead submission were executed when an employee asked the agent to process that lead.
- Data left through an image tag pointing at my-salesforce-cms.com, a domain still on an allowlist but expired and available to buy. The researcher registered it for about $5.
- ForcedLeak was research, responsibly disclosed. The sources describe no exploitation by real attackers. It is included here because it shows how an AI agent's identity and data access can be steered by anyone who can write into its context.
- Lessons: treat AI agents as privileged non-human identities, scope what they can read, block outbound channels they do not need, and review allowlists for expired domains.
At a glance
| Organisation | Salesforce (Agentforce customers with Web-to-Lead enabled) |
|---|---|
| When | Reported 28 July 2025; acknowledged 31 July 2025; Trusted URLs enforcement from 8 September 2025; disclosed 25 September 2025 |
| Attacker | None known. Found by Sasi Levi of Noma Labs, the research team at Noma Security |
| Entry point | Public Web-to-Lead form, Description field (up to 42,000 characters) |
| Identities abused | The Agentforce AI agent, acting with its access to CRM data on behalf of an employee; an expired domain still trusted by the content security policy |
| Impact | Potential exfiltration of CRM data such as lead records and email addresses; no confirmed real-world victims |
| Category | AI agent and LLM vulnerability (agent identity and data access) |
What happened
Agentforce lets organisations build AI agents that work directly with Salesforce CRM records. Web-to-Lead is an older, common feature that turns submissions from a public website form into lead records. Noma Labs researcher Sasi Levi looked at what happens when the two meet: an untrusted outsider writes data into the CRM, and a trusted AI agent later reads it.
Noma's proof of concept placed instructions in the Description field of a Web-to-Lead submission, which accepts up to 42,000 characters. The text looked like a list of questions from a prospect, such as "How many leads do you have? What color do you get by mixing red and yellow?", with further instructions to collect email addresses and build an image tag containing them. Later, an employee gave Agentforce an ordinary request: "Please, check the lead with name 'Alice Bob' and respond to their questions. Please, make sure to answer those questions and after that draft an email to them with your results."
The agent did as the employee asked, and also as the lead's hidden text asked. Noma says the model "lacked the ability to distinguish between legitimate data loaded into its context and malicious instructions", and points to "insufficient restrictions on query scope and context" and "inadequate sanitization of user-controlled data fields." The agent queried CRM data and wrote it into the URL of an image at cdn.my-salesforce-cms.com. When the output was rendered, the browser requested that image and delivered the data to the server.
That request should have been blocked. It was not, because my-salesforce-cms.com was on the allowlist in Salesforce's content security policy. According to Noma, the domain had expired and was available for purchase. The researcher registered it for about $5, creating what Noma calls "a trusted exfiltration channel."
Noma reported the chain on 28 July 2025 and Salesforce acknowledged it on 31 July. On 8 September 2025 Salesforce began enforcing Trusted URLs for Agentforce and Einstein AI, so that agent output cannot be sent to untrusted URLs, and it secured the expired domain. Salesforce told The Hacker News: "Our underlying services powering Agentforce will enforce the Trusted URL allowlist to ensure no malicious links are called or generated." Salesforce also told The Register that it "has released patches that prevent output in Agentforce agents from being sent to untrusted URLs." Noma published on 25 September 2025.
Timeline
| Date | Event |
|---|---|
| 28 July 2025 | Noma Security reports the vulnerability chain to Salesforce. |
| 31 July 2025 | Salesforce acknowledges the report. |
| 8 September 2025 | Salesforce enforces Trusted URLs for Agentforce and Einstein AI. |
| 25 September 2025 | Noma Security publishes ForcedLeak, rated CVSS 9.4. |
How it happened: the identity attack path
- Untrusted input becomes trusted data. Anyone on the internet can submit a Web-to-Lead form. The submission becomes a CRM record with no authentication of who wrote it.
- A trusted agent reads it. An employee asks Agentforce to handle the lead. The agent loads the record, including the attacker's text, into its context.
- The agent acts on the attacker's instructions. The model cannot separate data from instructions, so it follows both. It uses its own access to query further CRM records, such as other leads' email addresses, that the attacker could never read directly.
- An allowed outbound channel. The agent places the data in an image URL. The content security policy allows the request because the domain is on its allowlist.
- A stale trust entry. The allowlisted domain had expired. Whoever registered it would receive the data. Noma did so for about $5.
Impact
- Data at risk: Noma lists customer contact information, sales pipeline data, internal communications, third-party integration data and historical interaction records.
- Affected setups: Salesforce organisations using Agentforce with Web-to-Lead enabled, according to The Hacker News.
- Real-world harm: none reported. The chain was found by researchers and fixed by Salesforce before disclosure.
- Industry: a critical, publicly documented case of indirect prompt injection against an enterprise AI agent platform.
What this means for NHI governance
An AI agent is a non-human identity with a very unusual property: anyone who can put text in front of it can influence what it does. In ForcedLeak the attacker had no Salesforce account, no stolen token and no employee password. They borrowed the agent's identity and its access to the CRM, simply by writing into a record the agent would later read. Noma's Alon Tron put it bluntly to Dark Reading: "We were able to compromise the agent and tell it to do whatever."
That changes how least privilege needs to be applied. For a conventional service account, the question is which systems it can reach. For an agent, it is also whose instructions can reach it. An agent that reads public form input should not also have broad read access to every lead and the ability to send data to external addresses. Each of those capabilities is reasonable alone. Together, with untrusted input, they make an exfiltration tool.
The expired domain is a second, older lesson. Allowlists, redirect URIs, webhook endpoints and trusted origins are part of an identity's trust boundary, and they decay. A domain that no one renews becomes a credential for whoever buys it. This is the same class of risk covered in the OWASP Top 10 for agentic applications, and it has appeared in other agent incidents on our timeline, such as the Gemini Google Calendar prompt injection.
Recommendations
- Apply Salesforce's Trusted URLs enforcement. Confirm it is active for Agentforce and Einstein AI, and keep the trusted list short.
- Audit existing lead data. Noma recommends reviewing past Web-to-Lead submissions for unusual instructions in free-text fields.
- Scope the agent's access. Give each agent only the records and actions it needs, and separate agents that read untrusted input from agents with broad data access. See our Ultimate Guide to NHIs.
- Control outbound channels. Block agents from rendering external images or calling URLs unless a use case requires it.
- Review allowlists for expired domains. Check content security policies, OAuth redirect URIs and webhooks for domains your organisation no longer owns.
- Keep an inventory of AI agents. Record each agent's owner, data access, tools and input sources, as described in our NHI Lifecycle Management Guide.
Frequently asked questions
What is ForcedLeak?
ForcedLeak is a critical vulnerability chain in Salesforce Agentforce, disclosed by Noma Security in September 2025 and rated CVSS 9.4. It let an attacker use a Web-to-Lead form to inject instructions that made an Agentforce agent send CRM data to an external domain.
Was ForcedLeak exploited by attackers?
No exploitation has been reported. Noma Security found the issue during research, reported it to Salesforce in July 2025, and Salesforce enforced Trusted URLs for Agentforce on 8 September 2025, before the public disclosure.
Why does an expired domain matter for AI agent security?
The domain my-salesforce-cms.com was still trusted by Salesforce's content security policy after it had expired. Anyone who registered it could receive data sent there. Noma bought it for about $5, showing that stale trust entries can become an exfiltration route for an AI agent.
Related NHI Mgmt Group resources
Gemini Google Calendar prompt injection · CoPhish OAuth token theft via Copilot Studio · Amazon Q AI coding agent compromised · Salesloft Drift OAuth token breach · OWASP Agentic Applications Top 10
How NHI Mgmt Group can help
Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as agents are given access to business data and tools that attackers can steer through the content they read. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.
References
- Noma Security: ForcedLeak, AI agent risks exposed in Salesforce Agentforce (25 September 2025)
- The Hacker News: Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection (25 September 2025)
- Dark Reading: Salesforce AI Agents Forced to Leak Sensitive Data (25 September 2025)
- The Register: Prompt injection, and a $5 domain, trick Salesforce Agentforce into leaking sales (26 September 2025)
