Topic starter
14/07/2026 6:08 pm
TL;DR: Salesforce patched the ForcedLeak flaw in Agentforce after researchers showed indirect prompt injection could exfiltrate CRM data through Web-to-Lead workflows and an expired allowlisted domain, according to Swarmnetics. The case shows approval boundaries and input trust assumptions collapse when generative systems execute instructions from untrusted content.
Editorial analysis by NHI Mgmt Group, based on content published by Swarmnetics: ““ForcedLeak” Vulnerability in Agentforce Platform Addressed by Salesforce”.
Key questions
Q: What breaks when indirect prompt injection is not controlled in AI systems?
A: Indirect prompt injection breaks the assumption that retrieved content is safe to use as instruction material.
Q: Why do allowlisted domains increase risk in AI agent workflows?
A: Allowlisted domains can become trusted delivery channels for exfiltration when an agent is allowed to send data outward without strong destination governance.
Q: What are the signs that an AI agent may be vulnerable to prompt injection?
A: Look for mismatches between the prompt a system received and the actions it attempted, especially unexpected data retrieval, unusual API calls, or tool use that does not match the user's request.
Practitioner guidance
- Audit prompt-to-action boundaries Map every place where untrusted content can flow into agent instructions, tool calls, or outbound messages.
- Revalidate allowlisted domains Check whether approved callback or delivery domains are still owned by the intended party and still appropriate for data transfer.
- Disable high-risk tools for untrusted inputs Block email, CRM export, and similar data-moving tools when the triggering content came from external or untrusted sources.
Bottom line: ForcedLeak shows that an AI agent can be steered by hidden instructions inside ordinary business content, turning intake workflows into execution paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 6:12 pm
ForcedLeak is an assumption collapse, not just a vulnerability: the workflow assumed that content entering a lead form would remain data until a human decided otherwise. That assumption fails when an AI agent can reinterpret the same content as instruction and then act on it without preserving the original trust boundary. The implication is that agent governance must be built around instruction provenance, not around the historical shape of the business process.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.
👉 Read our full editorial: ForcedLeak exposes how indirect prompt injection breaks agent trust