"ForcedLeak": Salesforce Agentforce prompt injection via Web-to-Lead, per Noma Security

Summary

Noma Labs reported a CVSS 9.4 chain in which malicious Web-to-Lead submissions led Agentforce to send CRM data to a whitelisted domain that "had expired and become available for purchase." Noma says Salesforce released patches and re-secured the domain.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

• MEASURE 2.7 Security and resilience are evaluated and documented
• GOVERN 6.1 Policies address risks from third-party software and data

NIST SP 800-53

• AC-4 Information Flow Enforcement
• SI-10 Information Input Validation
• CM-7 Least Functionality

Human-approval (JCR) checkpoint

not applicable

Correlated incidents

Co-occurrence, not cause: each link records something the two incidents share, as its rationale and source state. It does not say one incident caused the other. Links are written on one record; the other record shows the same link marked derived.

• Cyber CYB-005 Data exported from Salesforce instances through compromised Salesloft Drift OAuth tokens, per Google Threat Intelligence Group

  same vendor derived from CYB-005

  Both concern Salesforce customer data reached through a connected integration: compromised Salesloft Drift OAuth tokens, per GTIG, and an Agentforce prompt-injection chain that sent CRM data to an expired domain, per Noma.

  Source: noma.security https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce/

Sources

• noma.security primary link checked 2026-10-31, HTTP 200
  Post dated Sep 25, 2025
  https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce/

Corrections

No corrections recorded.

To report an error in this entry, see corrections.