ForcedLeak: How a Web Form and a $5 Expired Domain Turned Salesforce Agentforce Against Its Own CRM
Key takeaways
- →Noma Security found that malicious instructions in the description field of a Salesforce Web-to-Lead form were executed later by Agentforce when an employee asked about that lead.
- →The agent was told to gather CRM data and embed it in an image URL. The URL pointed at a domain still on Salesforce's trusted list that had expired, and the researchers re-registered it for about $5.
- →AgentGuard would have caught instructions coming from untrusted lead data and blocked the outbound request carrying CRM records, whatever the destination's allow-list status.
- 1
Attacker submits lead form with hidden instructions
- 2
Employee asks Agentforce about the new lead
- 3
Agent executes injected instructions
AgentGuard rejects instructions from untrusted lead data and blocks CRM data leaving in the request
- 4
CRM data embedded in image URL to expired trusted domain
- 5
Data lands on attacker-owned server
- Affected
- Salesforce Agentforce customers using Web-to-Lead (fixed by Salesforce)
- When
- Patched September 8, 2025 · disclosed September 25, 2025
- Impact
- Exfiltration of sensitive CRM data such as lead and contact records
What happened
Web-to-Lead is how countless companies capture prospects. It's a public form that writes straight into Salesforce. Noma Security found that the form's description field had room for a long block of text. An attacker could plant instructions there that looked like a normal question set but also told the AI to collect lead data and output it inside an HTML image tag.
When an employee later asked Agentforce to work with that lead, the agent read the record, followed the hidden instructions and produced an image request carrying CRM data. Salesforce's content security policy allowed it, because the destination was on its trusted-domain list. That domain had expired, and the researchers bought it for about five dollars.
Noma rated the chain CVSS 9.4. Salesforce fixed it by enforcing Trusted URL allow-lists for Agentforce and Einstein AI as of September 8, 2025, and secured the expired domain. The findings were published on September 25, 2025.
Why nothing caught it
The attacker never logged in. They used a public form, exactly as intended. The agent acted with the employee's legitimate access, and the data left toward a domain the platform itself trusted. The weak link was a forgotten allow-list entry, which is the kind of configuration debt every enterprise has.
- The form submission passed every input check
- The agent used valid employee permissions
- CSP allowed the destination: it was on the trusted list
- The delay between injection and execution hid cause from effect
How AgentGuard would have stopped it
AgentGuard tracks instruction lineage. It records where each instruction an agent follows came from. Here, the commands came from an anonymous public form field, not from the employee or an approved workflow. That alone marks them as untrusted data, never instructions.
AgentGuard also enforces task context on outbound data. The employee wanted lead details on screen, and nothing about that task calls for CRM records to leave the tenant in a URL. AgentGuard blocks the request at step three, whether or not the domain appears on any allow-list. Allow-lists rot; task context doesn't.
What to do Monday
If your agents read customer-submitted data, attackers can talk to them.
- Audit and prune trusted-domain allow-lists, including expired domains
- Treat Web-to-Lead and support forms as untrusted AI input
- Restrict agents from rendering external images or links
- Monitor agent output for CRM data leaving the tenant
The lesson
Each of these attacks used an AI system that was doing exactly what it was allowed to do, on behalf of someone it should never have obeyed. Patches close one path at a time. AgentGuard closes the class: it judges every agent action against the agent's task, its Principal and its environment, with zero integration and deployment measured in days.
Frequently asked questions
What is ForcedLeak?
ForcedLeak is a CVSS 9.4 vulnerability chain in Salesforce Agentforce found by Noma Security. Instructions hidden in a Web-to-Lead form made the agent leak CRM data to an expired, still-trusted domain. Salesforce patched it on September 8, 2025.
Why was the expired domain important?
Salesforce's content security policy allowed requests to domains on its trusted list. One listed domain had expired, so the researchers bought it for about $5 and received data the platform considered safe to send.
How does AgentGuard prevent ForcedLeak-style attacks?
AgentGuard treats content from untrusted sources, like public forms, as data rather than instructions. It also blocks agent requests that move sensitive data outside the scope of the user's task, regardless of allow-lists.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.