Topic starter
16/01/2026 1:55 pm
TL;DR: A CVSS 9.4 ForcedLeak chain in Salesforce Agentforce could let attackers exfiltrate CRM data through indirect prompt injection, using Web-to-Lead input, context confusion, and a CSP bypass to trigger unauthorized output, according to Noma Security. Agentic systems expand identity risk beyond prompts into tools, memory, and downstream data flows, so governance must move to runtime trust boundaries.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “Forcedleak: AI agent risks exposed in salesforce agentforce”.
Key questions
Q: What breaks when untrusted CRM data is allowed into an AI agent's context?
A: The boundary between data and instruction breaks down.
Q: Why do AI coding agents create more data exposure risk than chatbots?
A: Because they can inspect repository context, read terminal output, and retrieve nearby files without the user manually pasting everything.
Q: What are the signs that an AI agent may be vulnerable to prompt injection?
A: Look for mismatches between the prompt a system received and the actions it attempted, especially unexpected data retrieval, unusual API calls, or tool use that does not match the user's request.
Practitioner guidance
- Map every agent input to a trust class Separate public form fields, partner-fed records, and internal records before they can influence model context or tool use.
- Inventory outbound trust dependencies Review every allowlisted domain, callback target, and image or link destination that an agent can reach.
- Constrain agent output before downstream use Apply output validation for any agent response that can be copied into email, CRM notes, links, or browser requests.
Bottom line: ForcedLeak shows that prompt injection can become a CRM exfiltration problem when an AI agent confuses untrusted data with instructions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 5:34 pm
Context boundaries, not just prompts, are now the governance problem. ForcedLeak shows that AI agent risk begins where untrusted data is allowed to enter a system that later interprets it as context. That breaks the older assumption that only explicit user prompts need inspection. In agentic environments, the data plane and instruction plane can collide inside the same runtime. Practitioners must treat context ingestion as an authorisation event, not a parsing task.
A few things that frame the scale:
- 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
A question worth separating out:
Q: How should security teams govern AI agents in marketing workflows?
A: Treat each marketing agent as a governed identity with a named owner, a defined purpose and bounded permissions. The control question is not whether the tool can automate work, but whether it is authorised to act on customer data, spend or messaging within a clear intent envelope. Without that, the organisation can authenticate the agent but cannot explain or constrain its behaviour.
👉 Read our full editorial: ForcedLeak shows why AI agent prompt injection expands CRM risk