TL;DR: Salesforce patched the ForcedLeak flaw in Agentforce after researchers showed indirect prompt injection could exfiltrate CRM data through Web-to-Lead workflows and an expired allowlisted domain, according to Swarmnetics. The case shows approval boundaries and input trust assumptions collapse when generative systems execute instructions from untrusted content.
At a glance
What this is: ForcedLeak is a patched Agentforce flaw that let malicious lead content steer an AI agent into exfiltrating CRM data through a whitelisted domain.
Why it matters: AI agent governance now has to treat untrusted content as an execution path, because prompt injection can turn ordinary intake workflows into data exfiltration channels.
Context
ForcedLeak is an indirect prompt injection issue in an AI agent workflow, where malicious instructions hidden inside normal business content are later executed by the agent. The governance problem is not the model alone, but the trust boundary between external input, internal review, and downstream tool use.
In this case, Salesforce Agentforce installations with Web-to-Lead enabled could be pushed into querying CRM data and sending it out through a whitelisted domain. That makes the identity question central: what the agent is allowed to read, what it is allowed to act on, and when untrusted content becomes executable intent.
The article also shows why agentic systems cannot inherit human approval assumptions from the processes around them. If intake data is accepted as benign until proven otherwise, a malicious payload can survive long enough for the agent to turn it into action.
Key questions
Q: What breaks when indirect prompt injection is not controlled in AI systems?
A: Indirect prompt injection breaks the assumption that retrieved content is safe to use as instruction material. Once malicious text enters the model context, the system may alter responses, leak data, or trigger tools with delegated permissions. The core failure is boundary collapse between data and directive, which turns ordinary content ingestion into an execution risk.
Q: Why do allowlisted domains increase risk in AI agent workflows?
A: Allowlisted domains can become trusted delivery channels for exfiltration when an agent is allowed to send data outward without strong destination governance. If the domain ownership changes, expires, or is loosely monitored, the trust boundary is weakened. The problem is not the allowlist itself, but the assumption that every allowed destination remains safe over time.
Q: What are the signs that an AI agent may be vulnerable to prompt injection?
A: Look for mismatches between the prompt a system received and the actions it attempted, especially unexpected data retrieval, unusual API calls, or tool use that does not match the user's request. Those are strong indicators that input steering is affecting execution.
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.
Technical breakdown
How indirect prompt injection crosses the trust boundary
Indirect prompt injection places attacker instructions inside content that looks ordinary to the system, such as lead forms, emails, or retrieved documents. When the agent later processes that content, it can treat the embedded text as operational guidance rather than untrusted input. In this case, the attack only worked because the content passed through a workflow the platform considered safe enough to process. The technical failure is a broken separation between data ingestion and instruction execution, which is especially dangerous in retrieval-augmented or workflow-connected agents.
Practical implication: isolate untrusted inputs from instruction-following paths before they reach agent reasoning or tool selection.
Why whitelisted domains do not equal safe execution
Allowlisting is usually used to restrict where data may be sent, but it does not validate the intent of the content that triggered the send. Here, the expired allowlisted domain became attacker-controlled, so the trust anchor that was meant to make delivery safe instead created a clean exfiltration path. The agent then sent sensitive CRM content as a PNG image, which shows how output encoding can be used to disguise data movement. Trusting the destination without verifying ownership, freshness, and use context is not enough.
Practical implication: revalidate allowlisted destinations continuously and tie them to ownership, not just static approval.
Why manual review and tool gating still matter
Agentforce-style workflows can look safe if a human is nominally in the loop, but the human often reviews only the lead record, not the embedded instructions the model will later follow. That leaves a gap between content ingestion and downstream action, especially when tools such as email or CRM lookups are available by default. The article's recommendation to disable email tool use for untrusted inputs and require manual review before CRM data leaves the system points to the same technical reality: the highest risk is not model output alone, but autonomous execution of tainted context.
Practical implication: gate high-risk tools on input provenance, not just on whether a person touched the workflow.
Threat narrative
Attacker objective: The attacker wanted the AI agent to expose CRM-held lead data through an apparently legitimate outbound channel.
- Entry occurred through a malicious Web-to-Lead submission containing hidden instructions that looked like ordinary business data.
- The attacker relied on access to an expired allowlisted domain, which let the platform treat the later data flow as approved.
- The agent processed the poisoned content, queried CRM records, and packaged sensitive information for outbound delivery.
- Impact was exfiltration of lead-related data, including potentially names, contact details, identification numbers, health information, and banking information, depending on tenant setup.
Breaches seen in the wild
- EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
- ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
ForcedLeak is an assumption collapse, not just a vulnerability: the workflow assumed that content entering a lead form would remain data until a human decided otherwise. That assumption fails when an AI agent can reinterpret the same content as instruction and then act on it without preserving the original trust boundary. The implication is that agent governance must be built around instruction provenance, not around the historical shape of the business process.
Indirect prompt injection exposes an identity governance gap: the agent was not compromised in the classic sense, it was persuaded to exercise delegated authority against the wrong content. That matters because access policy alone cannot stop an identity that is technically authorised but contextually misled. Practitioners should treat content trust, action trust, and destination trust as three separate controls rather than one boundary.
Expired allowlists create trust debt: a static approved domain can silently turn into attacker infrastructure when ownership lapses. Once that happens, the control is no longer a safeguard but a pre-authorised exfiltration route. For AI agent programmes, domain review has to be treated as a lifecycle control, not a one-time security checkbox.
Web-to-Lead is no longer just a data intake pattern: in agentic environments, it becomes an instruction intake pattern as soon as the model can follow embedded commands. That changes how security teams should think about least privilege, because privilege is not only about who may access the record, but also about which content may influence what the agent does next.
Agentic trust models need a named control concept, not vague caution: the right concept here is prompt-to-action boundary governance. It describes the point where untrusted text becomes executable agent behaviour, and it is the line that failed in this case. Practitioners should use that boundary as the unit of design, review, and audit across AI agent workflows.
From our research library:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- Read next: AI Agent Authorisation Guide
What this signals
Prompt-to-action boundary governance: AI agent programmes now need a control line that separates untrusted input from executable intent. If a workflow lets external content influence tool use without an independent validation step, the agent is effectively governing itself on attacker-supplied terms.
Agent identity risk is no longer limited to credentials and permissions. It also includes the freshness of the trust anchors around domains, callbacks, and downstream channels, because a stale allowlist can become a clean path for data loss.
According to the State of Secrets in AppSec, 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases. That concern is consistent with ForcedLeak: the problem is not only exposure, but the way AI systems can operationalise untrusted patterns once they are inside the workflow.
For practitioners
- Audit prompt-to-action boundaries Map every place where untrusted content can flow into agent instructions, tool calls, or outbound messages. Remove any assumption that a human viewing the record automatically validates the model's later action.
- Revalidate allowlisted domains Check whether approved callback or delivery domains are still owned by the intended party and still appropriate for data transfer. Expired or transferred domains should be treated as broken trust, not as active exceptions.
- Disable high-risk tools for untrusted inputs Block email, CRM export, and similar data-moving tools when the triggering content came from external or untrusted sources. Use provenance-aware controls so tool access depends on the origin of the input, not just on role.
- Add manual review before sensitive egress Require explicit human review before any workflow that can send CRM data outside the platform. The review should inspect both the data and the instructions that might be embedded inside it.
Key takeaways
- ForcedLeak shows that an AI agent can be steered by hidden instructions inside ordinary business content, turning intake workflows into execution paths.
- The incident was severe enough to earn a CVE score of 9.4, and it relied on a stale allowlisted domain that had expired and been taken over.
- The practical control point is the boundary between untrusted input and agent action, where provenance checks, tool gating, and manual review have to work together.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The agent was manipulated into using tools against attacker-supplied instructions. |
| ASI03 — Identity & Privilege Abuse | The flaw abused delegated agent authority to retrieve and disclose CRM data. | |
| ASI09 — Human-Agent Trust Exploitation | The attack exploited trust in content that humans and agents both treated as benign. | |
| Recommendation — Restrict tool execution when untrusted input can influence agent decisions. Constrain agent privileges so delegated access cannot be redirected by injected content. Validate the provenance of external content before allowing it to influence agent actions. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The expired allowlisted domain shows a broken trust anchor for agent egress. |
| NHI-03 — Vulnerable Third-Party NHI | The attacker-controlled expired domain became the third-party trust surface used for exfiltration. | |
| Recommendation — Recheck approved domains and revoke stale trust relationships before they become attack paths. Inventory external trust dependencies and remove any stale third-party identity paths. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The incident exposes a governance failure in how agent authority and review boundaries were defined. |
| Recommendation — Define accountability for agent-triggered disclosures and review where human oversight actually applies. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The attack used malicious content to reach sensitive records and move them out of the environment. |
| Recommendation — Map prompt-injection-driven disclosure paths to TA0006 and TA0010 in detection planning. | ||
Key terms
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Prompt-to-Action Boundary: The prompt-to-action boundary is the point where informational content becomes an executable instruction. For coding agents, that boundary determines whether repository text, ticket comments, or tool output can trigger access to files, secrets, or external systems.
- Allowlist Expiry Risk: Allowlist expiry risk is the failure mode where a previously approved domain, endpoint, or callback target loses its original ownership but remains trusted by a workflow. The security problem is not the allowlist itself, but the absence of lifecycle review that keeps stale trust active.
- Human-Agent Trust Exploitation (ASI09): An attack where an AI agent's fluency and apparent authority are weaponised to manipulate human users into approving harmful actions, exploiting the tendency to over-trust confident AI outputs.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 14, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org