Topic starter
24/07/2026 4:10 pm
TL;DR: ForcedLeak shows how an indirect prompt injection can exfiltrate CRM data from AI-integrated business tools by hiding malicious instructions in ordinary user-controlled fields, according to Noma Security. The incident shows that AI access controls must govern data provenance, tool execution, and trusted URLs together, not as separate problems.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “AI Agent risk exposed in Salesforce Agentforce”.
Key questions
Q: What fails when AI agents treat customer data as instructions?
A: The failure is a collapsed trust boundary.
Q: Why do AI CRM agents need outbound URL controls?
A: Because a successful prompt injection often becomes harmful only when the agent can send data somewhere external.
Q: What are the signs that an AI agent is being manipulated into unauthorized actions?
A: Warning signs include unexpected data retrieval, unusual tool calls, changes in agent decisions after hostile or extreme inputs, and outputs that reflect hidden instructions rather than the user’s request.
Practitioner guidance
- Audit all externally sourced lead and ticket fields Review user-controlled records for unusual instructions, technical language, and embedded references to data processing that do not match normal business content.
- Enforce outbound destination allow lists for agents Limit which domains and endpoints AI agents can contact when they have access to sensitive business data, and block arbitrary image or URL fetches.
- Inventory every production AI agent Document each agent’s data sources, tool permissions, owning team, and whether it can operate on CRM or other sensitive records.
Bottom line: ForcedLeak shows that indirect prompt injection can turn ordinary CRM fields into an execution channel for hidden instructions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:13 pm
ForcedLeak shows that AI agent governance fails when teams treat content, identity, and outbound connectivity as separate control domains. The payload did not need traditional code execution to cause harm. It only needed a trusted workflow, a data field that accepted attacker input, and an agent able to act on that input inside a privileged context. Practitioners should treat AI-assisted CRM workflows as governed execution paths, not passive productivity features.
A question worth separating out:
Q: How should organisations govern AI agents that need database access?
A: Organisations should give AI agents narrow read access by default, separate write privileges from query privileges, and require human approval for any session that can modify data. That keeps agent activity inside a clearly bounded role while preserving auditability and reducing the chance of unsupervised state change.
👉 Read our full editorial: ForcedLeak shows how prompt injection breaks AI CRM trust boundaries