Security brief

ForcedLeak research showed an Agentforce prompt-injection path through lead forms

REVIEW

Noma’s 2025 disclosure connected attacker-controlled form content with CRM access and an outbound trust weakness.

Published 29 Oct 2026 · Material update 25 Sep 2025 — last time the underlying evidence changed · Evidence: medium

What happened

The Hacker News reported that Noma Security disclosed ForcedLeak, a prompt-injection chain involving Salesforce Agentforce and Web-to-Lead forms. Malicious instructions in a form field could influence an agent processing the resulting record.

The research combined that input path with an outbound domain-trust weakness to demonstrate potential CRM data exfiltration. Salesforce addressed the reported issue; the disclosure does not establish that customer data was stolen in the wild.

Organizations using connected CRM agents should review trusted destinations, connector permissions and how external form content reaches agents. Treat this as a historical disclosure and consult current Salesforce guidance for deployment-specific requirements.

Read the original source.

Next step

Review agent data permissions and outbound trusted destinations.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references