Threat
ForcedLeak 2025: Salesforce Agentforce Prompt Injection
First reported · Discovered nhimg.org
Page published
Earliest dated coverage: 25 Sep 2025 · First observed: 21 Oct 2026 · Latest dated coverage: 25 Sep 2025
Coverage timeline
Single-source analysis — one report is available.
Why it matters
ForcedLeak demonstrates how public-form content can hijack an AI agent's CRM privileges, highlighting the need for least-privilege access, isolation of untrusted content, and outbound allowlist hygiene.
ForcedLeak is a demonstrated vulnerability chain in Salesforce Agentforce that let unauthenticated attackers plant instructions in Web-to-Lead submissions, causing an employee-triggered agent to query other CRM records and exfiltrate the results. Researchers bypassed outbound restrictions using an expired, still-allowlisted domain purchased for about $5. Salesforce began enforcing Trusted URLs on 8 September 2025; the source reports responsible-disclosure research, not exploitation by real attackers.