Salesforce Fixes Critical ForcedLeak AI Data Leak

Artificial intelligence is transforming how businesses manage customer relationships, automate workflows, and process information. However, connecting AI systems to sensitive enterprise data also introduces new cybersecurity risks.

One significant example is ForcedLeak, a critical vulnerability chain discovered in Salesforce Agentforce.

Security researchers demonstrated how malicious instructions hidden in customer-submitted information could manipulate an AI agent and potentially expose confidential customer relationship management (CRM) data.

The vulnerability received a reported CVSS severity score of 9.4, placing it in the critical category.

Salesforce addressed the issue in September 2025 through security changes that included enforcement of trusted URL restrictions for affected AI capabilities.

The discovery highlighted an important problem for businesses deploying AI agents: information that appears to be ordinary business data may contain instructions designed to manipulate automated systems.

In this article, we explain what ForcedLeak was, how the attack worked, how Salesforce responded, and what organizations can learn about securing enterprise AI systems in 2026.

What Is the Salesforce ForcedLeak Vulnerability?

ForcedLeak is the name given to a security vulnerability chain affecting Salesforce Agentforce.

Agentforce is Salesforce's platform for building AI-powered agents that can assist with customer service, sales processes, and business workflows.

These agents may retrieve information from Salesforce records, interpret customer requests, and perform authorized tasks.

ForcedLeak demonstrated how an attacker could exploit the way an AI agent handled information retrieved from a CRM database.

What made ForcedLeak dangerous?

The vulnerability involved several security weaknesses operating together.

These included:

• Malicious instructions embedded in untrusted CRM data

• Insufficient separation between data and instructions

• AI processing of attacker-controlled information

• A weakness involving trusted external domains

• The potential transmission of sensitive CRM information

The attack did not require an attacker to log directly into Salesforce using stolen employee credentials.

Instead, researchers demonstrated how externally submitted information could influence an agent during a legitimate business workflow.

This type of attack is known as indirect prompt injection.

Who Discovered ForcedLeak?

ForcedLeak was discovered by cybersecurity researchers at Noma Labs, part of Noma Security.

The researchers investigated how Salesforce Agentforce handled external information and whether malicious content could influence its behavior.

According to the published Noma Labs research, the vulnerability was reported to Salesforce on July 28, 2025.

Salesforce acknowledged the report on July 31, 2025.

The company subsequently implemented security changes, including Trusted URL enforcement, on September 8, 2025.

Noma Labs publicly disclosed its findings on September 25, 2025.

Reported vulnerability timeline

The research described a demonstrated vulnerability, not evidence that every Salesforce customer experienced a data breach.

That distinction is essential when evaluating the incident's impact.

How Did the ForcedLeak Attack Work?

ForcedLeak used a technique called indirect prompt injection.

To understand the vulnerability, consider how an AI-powered CRM assistant normally works.

A sales employee may ask an agent to summarize information about a prospective customer.

The AI system retrieves the relevant CRM record and generates a response.

This is useful when the information is trustworthy.

However, customer-submitted data may contain text controlled by external parties.

Step 1: Untrusted information enters the CRM

Salesforce Web-to-Lead functionality allows businesses to collect lead information through web forms.

These forms can contain names, contact information, and descriptions.

Researchers demonstrated how malicious instructions could be placed inside a field that would later be stored as part of a lead record.

Step 2: An employee makes a legitimate request

A Salesforce user might ask Agentforce to review or summarize information about a lead.

The request itself could be completely legitimate.

Step 3: The AI processes the malicious content

When retrieving the CRM record, the agent encounters attacker-controlled instructions embedded in the data.

The vulnerability arose because the system could treat those instructions as actionable requests instead of untrusted information.

Step 4: Sensitive information becomes exposed

In the research demonstration, the manipulated agent retrieved sensitive CRM information and generated output that could transmit data outside the intended environment.

This illustrates how an AI system can become a pathway for unauthorized information disclosure when trust boundaries are not enforced.

Understanding Indirect Prompt Injection

Prompt injection occurs when malicious instructions attempt to redirect an AI system away from its intended behavior.

A direct prompt injection usually involves instructions submitted directly to an AI interface.

Indirect prompt injection involves malicious instructions hidden in information the AI later retrieves.

Examples of potentially untrusted sources include:

• Customer support tickets

• Website content

• Uploaded documents

• Emails

• CRM records

• External search results

The AI may encounter this information while performing a legitimate task.

Why indirect attacks are challenging

Traditional software generally treats application instructions and stored data as different categories.

Language models process natural-language text, making it important to establish explicit boundaries between trusted instructions and external content.

A malicious instruction can resemble ordinary text unless the surrounding application applies effective controls.

This is why prompt injection remains an important enterprise AI security concern.

The Role of Salesforce Web-to-Lead

Web-to-Lead was an important component in the ForcedLeak research.

The feature allows external users to submit information that becomes available within Salesforce.

For businesses, this can simplify lead generation.

A prospective customer fills out a contact form, and the information becomes accessible to sales representatives.

However, information submitted through public forms should be treated as untrusted.

Why customer-controlled fields matter

A CRM record may appear to be part of an internal business system.

Nevertheless, some information inside that record may originate from an unknown external source.

If an AI agent treats all retrieved CRM content as trustworthy instructions, the distinction between external data and internal authority becomes blurred.

ForcedLeak demonstrated the consequences of that confusion.

Organizations should validate and appropriately handle customer-submitted information before allowing powerful AI systems to use it.

How the Trusted-Domain Weakness Contributed

The ForcedLeak attack chain also involved a weakness associated with trusted external domains.

Organizations commonly use allowlists to control which destinations their applications can access.

These lists can help restrict unauthorized network communication.

However, allowlists must be maintained carefully.

The expired-domain problem

Noma Labs identified a domain included in a Salesforce Content Security Policy configuration that had expired and become available for registration.

According to the researchers, obtaining control over that previously trusted domain was a critical element of their demonstration.

The research described a very low registration cost, illustrating how an overlooked configuration could undermine an otherwise meaningful security restriction.

Why this matters

A domain's presence on an allowlist does not guarantee that it remains trustworthy forever.

Ownership may change.

Services may be retired.

Previously legitimate infrastructure can become unsafe.

Organizations should regularly review trusted domains, external integrations, and network restrictions.

This lesson applies beyond Salesforce to any system that permits communication with approved external services.

What CRM Data Could Have Been at Risk?

CRM platforms often contain information that is important to business operations.

Depending on configuration and permissions, that information may include:

• Customer contact details

• Sales opportunities

• Lead records

• Business communications

• Account information

• Internal sales notes

• Historical customer interactions

ForcedLeak demonstrated the potential for unauthorized access to sensitive CRM information through an AI agent.

Potential business consequences

If a comparable weakness were exploited maliciously, consequences could include:

Confidentiality risks: Customer or business information could become accessible to unauthorized parties.

Operational disruption: Organizations might need to investigate AI workflows and restrict affected functionality.

Reputational damage: Customers may lose confidence in how businesses protect information.

Compliance concerns: Exposure of regulated personal information could trigger legal and contractual obligations.

However, these are potential consequences.

The public research does not establish that every organization using Agentforce suffered a breach or that customer data was stolen through widespread exploitation.

How Salesforce Responded to ForcedLeak

Salesforce investigated the reported vulnerability and introduced changes intended to prevent unauthorized data transmission through the demonstrated attack pathway.

A central mitigation involved Trusted URL enforcement for Agentforce and Einstein AI capabilities.

What Trusted URL enforcement does

Trusted URL controls restrict destinations that AI-generated content or related functionality can use.

These restrictions help reduce the ability of manipulated outputs to communicate with unapproved external locations.

Salesforce also addressed the domain-related weakness identified in the research.

Why the security response matters

The ForcedLeak case demonstrates that AI security often requires changes to the surrounding application environment.

Improving the language model's instructions alone may not be sufficient.

Effective protection may also require:

• Network restrictions

• Secure configuration

• Controlled tool access

• Input handling

• Output validation

• Appropriate authorization

Organizations should review applicable Salesforce security guidance and verify their own configurations.

Why ForcedLeak Is Important for Enterprise AI Security

Traditional chatbots primarily generate answers.

AI agents may have additional capabilities, including retrieving sensitive information, interacting with software, and supporting business processes.

These capabilities make AI more useful, but they also expand the consequences of malicious instructions.

AI agents interact with multiple systems

An enterprise agent might access a CRM, knowledge base, document repository, or external business application.

Each connection introduces information that may be incomplete, outdated, or attacker-controlled.

Actions increase potential consequences

An AI assistant that only summarizes public information has a different risk profile from an agent that can access customer records or initiate business actions.

Organizations need security controls that match the permissions and responsibilities of each agent.

Automation introduces new trust boundaries

Businesses adopting AI-powered marketing workflows must understand how information moves between applications and automated systems.

Sensitive data should remain protected even when an AI agent encounters malicious instructions.

Key Security Lessons From ForcedLeak

ForcedLeak offers practical lessons for organizations developing or deploying enterprise AI.

1. Treat external content as untrusted

Information from public forms, documents, websites, and messages should not automatically be treated as instructions.

Applications need clear separation between user-authorized requests and retrieved content.

2. Limit AI agent permissions

Agents should receive only the access necessary to perform their intended tasks.

For example, a lead-summary assistant may not need permission to retrieve every customer record.

3. Validate sensitive operations

High-risk actions should require appropriate checks.

Authorization should be enforced by application systems, not simply requested through natural-language instructions.

4. Review trusted integrations

Audit external domains, connected services, and permitted data destinations.

Remove obsolete configurations.

5. Monitor unusual behavior

Security teams should investigate suspicious data access, unexpected external communication, and abnormal agent actions.

6. Test AI workflows regularly

Security assessments should examine how agents respond to untrusted inputs, unexpected instructions, and unusual combinations of tools.

These practices can reduce risk across many AI-enabled business applications.

The Importance of AI Agent Security

AI agent security involves protecting systems that can interpret information and perform actions on behalf of users.

This extends beyond traditional application security because agents may combine natural-language reasoning with software permissions.

Core protection principles

Least privilege: Give agents only necessary access.

Trust boundaries: Separate authoritative instructions from untrusted data.

Human oversight: Require approval for appropriate high-risk actions.

Runtime monitoring: Observe important agent behavior and investigate suspicious patterns.

Data minimization: Limit access to unnecessary sensitive information.

Secure integrations: Review connected systems and external destinations.

Organizations also need clear ownership of deployed agents.

Without an inventory of agents and their permissions, security teams may struggle to assess exposure when a new vulnerability is discovered.

How AI Security Risks Affect Marketing Teams

ForcedLeak is particularly relevant to marketing and sales departments because these teams frequently use CRM automation.

Lead forms, marketing platforms, chatbots, and customer databases often exchange information.

AI agents can make these workflows more efficient.

However, they also increase the importance of data governance.

Marketing-related risks

Potential concerns include:

• Malicious content submitted through lead forms

• Unauthorized access to customer records

• Insecure third-party integrations

• Excessively broad AI permissions

• Mishandling of personal information

Marketing teams should collaborate with IT and security personnel when deploying automated systems.

A privacy-first personalization strategy should account for security as well as transparency and customer consent.

Customer trust depends on responsible information handling throughout the marketing process.

What Businesses Using Salesforce Agentforce Should Do

Organizations using Salesforce AI capabilities should review their security configurations and relevant vendor guidance.

Review security updates

Confirm that applicable Salesforce security changes are active.

Examine AI agent permissions

Determine which records, tools, and actions each agent can access.

Remove unnecessary privileges.

Audit external data sources

Identify forms, documents, or systems that introduce untrusted information into agent workflows.

Review trusted destinations

Confirm that approved external domains and integrations remain necessary and under appropriate control.

Investigate suspicious records

Look for unusual content in externally submitted CRM information.

Test critical workflows

Evaluate whether the agent can be redirected into accessing data or performing actions outside its intended scope.

Where appropriate, use controlled security testing conducted by qualified professionals.

Organizations should also maintain incident response procedures for potential AI-related security events.

Broader Cybersecurity Trends Behind ForcedLeak

ForcedLeak reflects a broader shift in cybersecurity as AI systems become more capable.

Security teams must increasingly evaluate not only software vulnerabilities but also the behavior of AI systems connected to business data.

Prompt injection is becoming a major security concern

Attackers may attempt to influence AI systems through documents, websites, or other external content.

AI tools expand the attack surface

New integrations and automation capabilities create additional pathways that security teams must monitor.

Dual-use tools complicate risk assessment

AI penetration-testing tools can support authorized security assessments, but similar capabilities may also raise misuse concerns.

Traditional threats remain relevant

Organizations must continue defending against familiar risks, including phishing, credential theft, and mobile malware threats.

AI security should complement established cybersecurity practices rather than replace them.

How to Reduce the Risk of AI Data Leaks

Businesses can reduce exposure through a layered security approach.

Establish clear AI governance

Document which AI agents are deployed, what data they access, and who is responsible for them.

Apply access restrictions

Use role-based permissions and minimize access to sensitive records.

Protect external interfaces

Treat public forms and imported information as potentially untrusted.

Monitor data movement

Review unusual access patterns and unexpected communication with external destinations.

Require approval for sensitive actions

Use appropriate human review or independent authorization controls.

Train employees

Help staff recognize that AI-generated answers and retrieved information may contain errors or malicious instructions.

Maintain an incident response plan

Prepare procedures for investigating suspicious agent behavior and protecting potentially exposed data.

These controls are more reliable when implemented together.

Frequently Asked Questions

What is the Salesforce ForcedLeak vulnerability?

ForcedLeak was a critical vulnerability chain in Salesforce Agentforce that researchers demonstrated could allow sensitive CRM data to be exposed through indirect prompt injection.

Who discovered ForcedLeak?

The vulnerability was discovered and reported by Noma Labs in July 2025 and publicly disclosed in September 2025.

Was ForcedLeak patched?

Salesforce implemented security changes in September 2025, including Trusted URL enforcement, to address the demonstrated attack pathway.

What is indirect prompt injection?

Indirect prompt injection occurs when malicious instructions are hidden in external information that an AI system later retrieves and processes.

Did ForcedLeak affect all Salesforce customers?

The public research identified a vulnerability affecting particular Agentforce workflows and configurations. It did not establish that every Salesforce customer was compromised.

How can businesses protect AI agents?

Businesses should apply least-privilege access, validate untrusted inputs, restrict external communication, review agent permissions, and monitor unusual behavior.

Conclusion

The Salesforce ForcedLeak vulnerability demonstrated how AI-powered business systems can become vulnerable when untrusted data is treated as authoritative instructions.

Researchers showed how malicious content submitted through a lead form could influence Agentforce and create a pathway for sensitive CRM information to leave the intended environment.

Salesforce addressed the demonstrated vulnerability through security changes, including Trusted URL enforcement.

The incident provides an important lesson for organizations adopting AI agents.

Strong enterprise AI security requires more than protecting login credentials or writing better prompts.

Businesses must manage data access, enforce trust boundaries, maintain secure integrations, and continuously evaluate automated workflows.

As AI agents become more deeply integrated into customer service, marketing, and sales systems, protecting sensitive information must remain a central design priority.