ForcedLeak shows why AI agent prompt injection expands CRM risk

At a glance

What this is: This research shows how an indirect prompt injection chain in Salesforce Agentforce could turn Web-to-Lead data into CRM exfiltration through context confusion and a CSP bypass.

Why it matters: IAM, PAM, and AI governance teams need to treat agentic systems as runtime trust environments, because the attack surface now includes tools, memory, and external data sources.

Context

ForcedLeak is a prompt injection vulnerability chain in Salesforce Agentforce that turns untrusted lead submissions into an execution path for malicious instructions. The core problem is not just malformed input, but the collapse of the boundary between data that should be read and instructions that should be obeyed.

For identity and access teams, the important shift is that AI agents do not behave like static applications. They can process external content, invoke tools, and act on context in ways that create new trust assumptions around data sources, output handling, and integration scope.

Noma Security’s analysis shows why AI agent governance cannot stop at prompt filtering. Once a system can combine external data, internal context, and outbound actions, the relevant control question becomes where runtime trust is established and where it is enforced.

Key questions

Q: What breaks when untrusted CRM data is allowed into an AI agent's context?

A: The boundary between data and instruction breaks down. Once attacker-controlled text is allowed to shape the agent’s context, the model may treat it as actionable guidance rather than content to analyse. That creates a path for hidden commands, misrouting, or data leakage through normal business workflows, even when the original input looked like an ordinary lead record.

Q: Why do AI coding agents create more data exposure risk than chatbots?

A: Because they can inspect repository context, read terminal output, and retrieve nearby files without the user manually pasting everything. That broader reach means the agent can surface secrets or sensitive records the developer did not consciously select, so the main control problem becomes limiting what the agent can reach.

Q: What are the signs that an AI agent may be vulnerable to prompt injection?

A: Look for mismatches between the prompt a system received and the actions it attempted, especially unexpected data retrieval, unusual API calls, or tool use that does not match the user's request. Those are strong indicators that input steering is affecting execution.

Q: How should security teams govern AI agents in marketing workflows?

A: Treat each marketing agent as a governed identity with a named owner, a defined purpose and bounded permissions. The control question is not whether the tool can automate work, but whether it is authorised to act on customer data, spend or messaging within a clear intent envelope. Without that, the organisation can authenticate the agent but cannot explain or constrain its behaviour.

Technical breakdown

How indirect prompt injection crosses the data-instruction boundary

Indirect prompt injection works when attacker-controlled content is stored in a place the model later trusts as context. The model then treats the malicious text as if it were part of the task, even though it entered as data through a web form or other input channel. In this case, the Web-to-Lead description field became the delivery mechanism. The failure is not simple input corruption; it is a context boundary problem where the agent cannot reliably separate user data from instructions intended to steer behaviour.

Practical implication: classify every externally sourced field as untrusted context, not just untrusted input.

Why content security policy controls can become an exfiltration path

The research shows that a whitelist-based CSP can become part of the attack chain when a trusted domain expires or is repurposed. If an agent is allowed to send output to a domain that later falls outside the organisation’s control, the browser or integration layer may still treat it as trusted. That turns a defensive control into an outbound channel for data theft. The issue is not the CSP concept itself, but the operational assumption that approved domains remain safe indefinitely.

Practical implication: maintain trusted-domain inventories as living controls, not one-time configuration records.

Why agentic systems expand identity risk beyond prompts

An AI agent is not just a text interface. When it can retrieve knowledge, invoke tools, and generate downstream actions, the security model shifts from prompt hygiene to runtime authorisation and output governance. That makes the agent part of the access plane, not merely the user interface. In identity terms, the agent is effectively acting as a non-human executor with delegated reach into data and systems. That changes how least privilege, monitoring, and trust boundaries need to be defined.

Practical implication: govern agent tool use and outbound actions as privileged runtime behaviour, not as simple application logic.

Threat narrative

Attacker objective: The attacker aims to extract sensitive CRM data and related business information through the agent’s own processing and output path.

1. Entry occurred through a malicious Web-to-Lead submission carrying hidden instructions inside the Description field.
2. Credential access was not the issue; instead, the agent consumed attacker-controlled context and treated it as actionable input.
3. Escalation happened when the agent followed the injected instructions and produced output that incorporated sensitive CRM data.
4. Impact came when the response path used a trusted but expired domain, allowing data to be exfiltrated outside Salesforce-controlled boundaries.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Context boundaries, not just prompts, are now the governance problem. ForcedLeak shows that AI agent risk begins where untrusted data is allowed to enter a system that later interprets it as context. That breaks the older assumption that only explicit user prompts need inspection. In agentic environments, the data plane and instruction plane can collide inside the same runtime. Practitioners must treat context ingestion as an authorisation event, not a parsing task.

Trusted outbound paths are part of the attack surface. A CSP can look sound while still failing operationally if whitelisted destinations expire, drift, or are repurposed. This case shows that outbound trust is only as strong as the domain lifecycle behind it. The practical lesson is that outbound channels must be governed with the same discipline as credentials, because the exfiltration path is now a security control dependency, not an implementation detail.

Agentic AI changes what least privilege means. Traditional least privilege assumes a fairly stable mapping between a subject and its allowed actions. In an AI agent, the action set can be assembled at runtime from context, tools, and downstream integrations. That makes static privilege scoping incomplete on its own. The named concept here is the runtime trust boundary gap: the point at which static controls no longer describe what the agent can actually do.

Agent visibility has become an identity governance requirement. If organisations cannot inventory which agents exist, what data they can reach, and which systems they can invoke, they cannot assess blast radius after an injection event. This is not only a detection problem. It is a governance problem about ownership, lineage, and delegated execution scope across the agent estate. Practitioners should treat AI agent inventories and tool mappings as core identity records.

Prompt injection is now an access control issue in disguise. The real failure in ForcedLeak is that injected content was able to influence an execution path with business impact. That places the problem squarely in NHI and autonomous governance territory, not just model safety. The implication is that identity programmes need to define how agent instructions are authenticated, how tool calls are authorised, and how outbound actions are constrained.

From our research library:

• 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
• Read next: Agentic AI Identity Guide

What this signals

Runtime trust boundary gap: The key failure mode is not simply malicious input, but the point where untrusted context becomes executable inside an AI agent. Organisations that still rely on static prompt filtering will miss the moment when the agent assembles context, selects an action, and pushes data outward through a trusted path.

Agent inventories now need the same discipline as privileged account inventories. If teams cannot tell which agent can reach which CRM data, tools, or external destinations, they cannot contain an injection event or explain the blast radius after one. Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.

For practitioners, the lesson is that agent security is no longer an experimental overlay. It has become part of identity governance, because the control problem is who or what can act on data, not merely who can log in to a system.

For practitioners

• Map every agent input to a trust class Separate public form fields, partner-fed records, and internal records before they can influence model context or tool use. Any field that can carry attacker-controlled text should be treated as untrusted context and isolated from instruction-bearing prompts.
• Inventory outbound trust dependencies Review every allowlisted domain, callback target, and image or link destination that an agent can reach. Confirm that each domain is still owned, monitored, and intended for agent output rather than inherited from a stale configuration.
• Constrain agent output before downstream use Apply output validation for any agent response that can be copied into email, CRM notes, links, or browser requests. The control objective is to stop agent-generated content from becoming an exfiltration or phishing channel.
• Track agent lineage and tool scope Maintain an inventory of which agents can access which datasets, which tools they may invoke, and which business processes they support. That record should support rapid blast-radius assessment when an injection path is suspected.

Key takeaways

• ForcedLeak shows that prompt injection can become a CRM exfiltration problem when an AI agent confuses untrusted data with instructions.
• The attack chain depended on both context confusion and an expired trusted domain, showing that outbound trust controls matter as much as input validation.
• Teams need runtime trust boundaries, agent inventory discipline, and outbound control review to keep AI agents from turning business data into leakage paths.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Device Trust Boundary: The device trust boundary is the point where an endpoint is considered sufficiently verified to access systems, data, or services. It defines the security line between trusted and untrusted device states, based on posture, identity, integrity, and policy. In practice, it governs whether a device can authenticate, connect, or receive sensitive access.
• Secret Exfiltration Path: Any route by which sensitive material can leave an environment after it has been read, including shell commands, web requests, diagrams, logs, or rendered outputs. In AI-assisted workflows, the exfiltration path can be created by the assistant itself if output controls are too permissive.
• AI Agent Lineage: The record of what an AI agent is, who owns it, what data it can reach, and which tools or systems it can invoke. For governance, lineage helps teams understand blast radius, accountability, and whether the agent should be treated as a privileged runtime component.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.