Understanding the Salesforce ForcedLeak Vulnerability

Introduction to ForcedLeak

A recent cybersecurity report has shed light on a critical vulnerability found within Salesforce’s AgentForce platform, referred to as ForcedLeak. This vulnerability exposes a significant risk connected to the expanding use of autonomous AI agents in enterprise operations.

What is the ForcedLeak Vulnerability?

The ForcedLeak vulnerability specifically targets Salesforce AgentForce, an AI-integrated platform designed to manage complex tasks like customer communication and lead management. The crux of the issue lies in how these AI agents interpret external inputs. Unlike traditional chatbots that process static information, AI agents capable of autonomous reasoning and internal memory have a broader attack surface, making them more susceptible to security threats.

Researchers from Noma Labs discovered that malicious actors could insert harmful instructions into submissions made through Salesforce’s Web-to-Lead forms. This process allows the compromised data to be queried later by internal Salesforce users, leading the AI to unknowingly execute these embedded malicious commands. Consequently, this could potentially expose sensitive CRM information such as customer contacts, sales strategies, and third-party integrations.

How the Attack Works

The methodology behind this vulnerability involves several key phases:

1. Injection Point Identification

The investigation revealed that the "Description" field in Salesforce’s Web-to-Lead forms is particularly vulnerable because of its substantial character limit of 42,000. This made it an ideal location for embedding malicious payloads.

2. Crafting Realistic Prompts

Attackers devised lead data that appeared legitimate so that when Salesforce employees utilized AgentForce to review them, the AI would inadvertently execute the hidden harmful instructions.

3. Using Trusted Queries

A prompt such as “Please check the lead named ‘Alice Bob’ and answer their questions…” might seem harmless, but it could trigger the AI to act on malicious commands nested within the data.

4. Bypassing Content Security Policy

Salesforce’s Content Security Policy (CSP) permitted data transmission to certain whitelisted domains. Unfortunately, one of these domains, my-salesforce-cms.com, had expired and was subsequently acquired by researchers to demonstrate how data could be exfiltrated through what appeared to be a trustworthy channel.

Together, these elements create a highly impactful vulnerability chain, highlighting how Salesforce AgentForce could be manipulated to leak sensitive data without any direct user involvement.

Who Faces the Risk?

Any organization utilizing Salesforce AgentForce with Web-to-Lead capabilities is potentially vulnerable, especially in sectors such as sales, marketing, and customer acquisition. These sectors frequently gather external data from forms submitted by potential clients at events or through marketing campaigns, which can serve as a channel for malicious inputs.

Implications for Businesses and Security

The potential repercussions of the ForcedLeak vulnerability are serious:

Data Exposure

Sensitive customer information, internal communications, sales pipeline details, and historical CRM records might be open to unauthorized access.

Regulatory Risks

Companies face the likelihood of breach disclosure requirements and potential compliance violations resulting from these data exposures.

Reputational Damage

A confirmed data breach involving sensitive customer information could severely harm brand credibility and trust.

Opportunities for Lateral Movement

Given Salesforce’s extensive API capabilities and integrations with other business systems, attackers might move laterally across internal networks once they gain access.

Furthermore, the research indicated a potential for time-delayed execution, meaning that payloads could remain inactive until triggered by specific employee actions, complicating the detection and prevention efforts.

Salesforce’s Responsive Actions

Here’s a timeline of Salesforce’s response to this vulnerability:

• July 28, 2025: The vulnerability was first reported to Salesforce by Noma Labs.
• July 31, 2025: Salesforce confirmed receipt of the report and initiated an investigation.
• September 8, 2025: A patch was released, implementing Trusted URLs Enforcement for AgentForce and Einstein AI.
• September 25, 2025: The vulnerability was publicly disclosed.

Subsequent to the findings, Salesforce took decisive action by securing the expired domain from its whitelist and enhancing CSP measures to prevent similar issues in the future.

Through these efforts, Salesforce aims to fortify the security of its platforms and reduce the likelihood of such vulnerabilities being exploited in the future.