Salesforce Patches Critical Forced Leak Bug Exposing CRM Data via AI Prompt Injection
Summary: Noma Security disclosed a critical Salesforce Agentforce flaw codenamed ForcedLeak (CVSS 9.4), reported July 28, 2025, that uses indirect prompt injection through the Web-to-Lead form's Description field to exfiltrate CRM data to an expired Salesforce-related allowlisted domain that could be bought for as little as $5. Salesforce has re-secured the domain and patched Agentforce and Einstein AI agents to enforce a Trusted URL allowlist, after Noma described a five-step attack exploiting context validation weaknesses, permissive model behavior, and a Content Security Policy bypass.
What's compelling: A $5 expired domain was enough to turn a standard Web-to-Lead form into an exfiltration channel from your CRM, and Aim Labs describes ForcedLeak as a variant of the EchoLeak primitives it says are endemic to RAG-based agents.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Mentions
- CVE-2025-32711
- Related
- ⚡ Weekly Recap: iPhone Spyware, Microsoft 0-Day, Token Break Hack, AI Data Leaks and More Cyber Risks ·One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes Cyber Risks ·SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026