ForcedLeak shows how prompt injection breaks AI CRM trust boundaries

At a glance

What this is: ForcedLeak is an AI CRM trust-boundary flaw in Salesforce Agentforce where hidden instructions inside lead data could drive an agent to expose sensitive CRM information.

Why it matters: It matters because AI-integrated business tools can turn routine user data into an execution path, so identity, authorisation, and content trust controls must be governed together.

Context

ForcedLeak sits at the intersection of AI governance, CRM security, and identity-bound authorisation. The core problem is that an AI agent processing user-controlled business data can treat that data as both content and instruction, which breaks the assumption that enterprise records are passive inputs.

In this case, the trust boundary failed where lead submission, employee query, and agent execution overlapped. For IAM, PAM, and NHI practitioners, the important lesson is that delegated AI actions need provenance checks, constrained outbound behaviour, and visibility into which data sources can influence tool use.

Key questions

Q: What fails when AI agents treat customer data as instructions?

A: The failure is a collapsed trust boundary. If an AI agent can treat user-controlled business content as executable guidance, then a normal workflow can become an attack path. The control gap is not just model safety, but provenance, permission scope, and outbound behaviour. Teams need to stop assuming that data processed by an agent is automatically safe to act on.

Q: Why do AI CRM agents need outbound URL controls?

A: Because a successful prompt injection often becomes harmful only when the agent can send data somewhere external. Outbound URL controls limit exfiltration paths and reduce the chance that attacker-controlled domains receive sensitive records. They are especially important when the agent can fetch content, render images, or call external services from inside a trusted business workflow.

Q: What are the signs that an AI agent is being manipulated into unauthorized actions?

A: Warning signs include unexpected data retrieval, unusual tool calls, changes in agent decisions after hostile or extreme inputs, and outputs that reflect hidden instructions rather than the user’s request. In multi-agent environments, another signal is inconsistent behavior between agents, especially when one agent’s response appears to override normal guardrails or access boundaries.

Q: How should organisations govern AI agents that need database access?

A: Organisations should give AI agents narrow read access by default, separate write privileges from query privileges, and require human approval for any session that can modify data. That keeps agent activity inside a clearly bounded role while preserving auditability and reducing the chance of unsupervised state change.

Technical breakdown

How indirect prompt injection turns business data into instructions

Indirect prompt injection occurs when malicious instructions are hidden inside content an AI system is expected to process, such as lead descriptions, tickets, or documents. The model or agent then follows those instructions alongside the legitimate user request. In enterprise workflows, the danger is not only text manipulation. It is the combination of retrieval, tool execution, and privileged context that gives the payload operational effect. Once the agent can act on external content, the boundary between data and command becomes a governance problem, not just a model-safety problem.

Practical implication: Classify user-controlled fields as untrusted inputs and prevent them from influencing agent actions without explicit policy checks.

Why trusted URL allow lists matter in AI agent workflows

Trusted URL allow lists are a containment control for outbound requests. They reduce the chance that an agent can send data to attacker-controlled infrastructure after a successful injection. In ForcedLeak, the abuse path depended on making the agent return or fetch seemingly benign external content that could carry exfiltrated information. That makes outbound destination control part of the security model, not a secondary hardening step. For AI-integrated business tools, the relevant question is no longer only what the model can see, but where it can send data once influenced.

Practical implication: Restrict outbound destinations for agents and treat URL allow lists as a core control for preventing data exfiltration.

Why AI agent inventories and isolation are now governance controls

An AI agent inventory records which agents exist, what data they can reach, and what actions they can take. Without that inventory, teams cannot distinguish low-risk assistants from agents that can query CRM records or trigger external requests. Isolation is the complementary control because externally influenced agents should not inherit broad access to records, tools, or communications. This is especially important where the agent operates in a production workflow and interacts with live customer data. In other words, the identity of the agent, its permissions, and its data sources must be governed as one system.

Practical implication: Inventory every production agent and isolate any agent that can process external data and access sensitive business systems.

Threat narrative

Attacker objective: The attacker aimed to exfiltrate CRM data and potentially manipulate AI-assisted business workflows from within a trusted enterprise process.

1. Entry occurred when the attacker submitted a Web-to-Lead form containing hidden instructions inside an apparently normal lead inquiry.
2. Credential or access abuse happened when an internal employee later queried the AI about that lead and the agent executed the hidden commands in the user's workflow context.
3. Impact followed when the agent retrieved sensitive Salesforce CRM information and sent it out through attacker-controlled requests disguised as ordinary image or URL traffic.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ForcedLeak shows that AI agent governance fails when teams treat content, identity, and outbound connectivity as separate control domains. The payload did not need traditional code execution to cause harm. It only needed a trusted workflow, a data field that accepted attacker input, and an agent able to act on that input inside a privileged context. Practitioners should treat AI-assisted CRM workflows as governed execution paths, not passive productivity features.

Trusted URL enforcement is a boundary control, not a complete AI security strategy. Allow lists can reduce exfiltration paths, but they do not solve the underlying issue that agents may still interpret hostile input as instruction. The deeper failure mode is instruction trust without provenance validation. Teams should therefore pair outbound filtering with input provenance controls and agent permission scoping.

AI agent inventories have become a prerequisite for identity governance in enterprise AI. If a team cannot answer which agents can read customer records, call tools, or emit external requests, it cannot govern their risk. This is where NHI and agentic AI security intersect: the agent behaves like a non-human actor, but it must still be managed through lifecycle, ownership, and least-privilege discipline.

ForcedLeak validates a new concept: trust-boundary collapse in AI CRM workflows. When external content, internal queries, and agent actions blur into one execution chain, security controls that work on individual layers stop being sufficient. The practical conclusion is that governance must attach to the whole agent transaction, from input source to tool output.

From a framework perspective, the article aligns most closely with OWASP-AGENTIC ASI02, ASI03, and ASI09, because the failure involved tool misuse, identity and privilege abuse, and trust exploitation. That is the right lens for practitioners assessing whether their controls address behaviour, not just model output. Teams should map agent controls to the actual action path, not just the conversation layer.

What this signals

Trust-boundary collapse is the best name for this failure mode. The moment an agent can interpret external content, pull live CRM data, and emit outbound requests in the same transaction, classic data classification and access reviews stop being enough. Practitioners should redesign controls around input provenance, action scope, and outbound containment rather than around the model alone.

AI-integrated CRM tools need the same seriousness that teams already apply to service accounts and other non-human actors. If the agent can act on records, reach tools, and communicate externally, it is part of the production identity surface and should be governed as such. That means ownership, inventory, and isolation are operational controls, not paperwork.

AI agent identity becomes a governance issue here because the agent’s permissions define the blast radius of a prompt injection. A constrained agent with no broad CRM visibility and no arbitrary outbound connectivity has far less exploit value than one embedded in a privileged workflow. The practical signal for teams is simple: if you cannot bound the agent’s reach, you do not yet control the risk.

For practitioners

• Audit all externally sourced lead and ticket fields Review user-controlled records for unusual instructions, technical language, and embedded references to data processing that do not match normal business content.
• Enforce outbound destination allow lists for agents Limit which domains and endpoints AI agents can contact when they have access to sensitive business data, and block arbitrary image or URL fetches.
• Inventory every production AI agent Document each agent’s data sources, tool permissions, owning team, and whether it can operate on CRM or other sensitive records.
• Separate employee prompts from untrusted payloads Prevent internal queries from causing the agent to execute content that originated from external users without provenance checks and policy evaluation.
• Add anomaly monitoring for agent-led data access Watch for unusual access patterns, repeated record lookups, and unexpected external request behaviour in the 30 to 60 day window after suspicious submissions.

Key takeaways

• ForcedLeak shows that indirect prompt injection can turn ordinary CRM fields into an execution channel for hidden instructions.
• The critical weakness is not only model behaviour but the lack of joined-up control across provenance, action scope, and outbound requests.
• Teams should govern AI agents as production actors with inventories, limited permissions, and containment for external communications.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Trust boundary collapse: Trust boundary collapse occurs when a control that is supposed to validate or constrain identity can be redirected by attacker-controlled input. The result is that downstream access decisions inherit a false assumption, which can convert a minor parsing flaw into full system compromise.
• AI agent inventory: An AI agent inventory is a complete record of autonomous or semi-autonomous software entities, including their permissions, tools, and reachable resources. It is a governance baseline because teams cannot review, restrict, or remediate agent access until they know exactly what the agent estate contains.
• Outbound Containment: Restrictions on where an AI system can send data after it has processed input. It covers destination allow lists, blocked request types, and other controls that reduce the chance of exfiltration after prompt injection or other manipulation.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and secrets management. It is designed for practitioners who need to connect identity controls to emerging AI operating models.