--- title: "ForcedLeak: What Indirect Prompt Injection Against a CRM Agent Teaches Defenders" description: "A stranger filled in a web form. Weeks later a routine employee question moved CRM records to an outside server. This is the chain, and the four places it could have been severed." author: "Renn Calloway" category: "Attack Surface & Threat Modeling" date: 2026-10-22T14:40:02.008Z canonical: "https://agenticcyber.co/blog/forcedleak-lessons-indirect-prompt-injection-against-crm-agents" --- # ForcedLeak: What Indirect Prompt Injection Against a CRM Agent Teaches Defenders ![child, school, draw](https://cdn.pixabay.com/photo/2023/10/28/10/31/child-8347081_1280.jpg?w=1200&q=75) > A stranger filled in a web form. Weeks later a routine employee question moved CRM records to an outside server. This is the chain, and the four places it could have been severed. Nobody inside the company did anything out of the ordinary. Somebody in sales put an everyday question to an assistant about one lead record, and company data travelled to a server the business did not own. Noma Labs published that outcome under the name ForcedLeak, a chain of weaknesses in Salesforce Agentforce, and [assigned it a CVSS rating of 9.4 in the same write-up](https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce/). Everything here comes from the public record, meaning the researchers' own publication plus the trade reporting around it. The finder set the severity figure, which makes it an interested party's rating rather than an independent score, and the vendor has since shipped a mitigation. The analysis stays at the altitude of mechanism and defence. No payload appears, no reproduction procedure appears, and no live tenant was involved in producing this article. ## The Public Record, By Date DateEventSource 28 July 2025Researchers disclose the finding to the vendor[Security Affairs](https://securityaffairs.com/182676/hacking/forcedleak-flaw-in-salesforce-agentforce-exposes-crm-data-via-prompt-injection.html) 31 July 2025Vendor confirms receipt of the reportSecurity Affairs 8 September 2025Trusted URLs Enforcement shippedSecurity Affairs 25 September 2025Noma Labs publishes its analysis[Noma Labs](https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce/) Not disclosedUse of the chain against a real customer environment at any pointNo source found Per the trade reporting, only organisations operating the Web-to-Lead capability were exposed. About six weeks passed between disclosure and mitigation, which is an unremarkable interval for coordinated handling and worth saying plainly rather than presenting as a finding of its own. ## The Chain, Link By Link - **Outside prose enters a store the company trusts.** A publicly reachable lead-capture form accepted a generous free-text field. Whatever a stranger typed there was saved alongside every legitimate record, with nothing marking its origin. - **An ordinary question pulls it into context.** Weeks might pass. Then an employee asks the assistant about that specific lead, and the stored text arrives in the model's context window as part of the record. - **The model treats the stored text as direction.** Nothing in the pipeline distinguished material to be read from material to be obeyed, which is the researchers' own account of the root cause. > The researchers put the root cause as an inability "to distinguish between legitimate data" and instructions planted by somebody hostile. [Noma Labs](https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce/) - **Data departs by a route the platform already trusted.** One domain carried on the platform's own content security policy list had lapsed and could be registered by anyone, so the outbound request arrived at a destination the platform treated as legitimate. Three underlying weaknesses are named in the write-up: context validation that was too weak, model behaviour that was too permissive, and the policy bypass at the exit. Cut any one of the four steps above and this particular sequence stops, which is the productive way to read an analysis of this kind. ## Which Control Severs Which Link LinkControl that severs itOwnerEffort Outside prose storedField length limits, a provenance tag separating public submissions from internal entries, instruction-shaped text flagging as one imperfect layerCRM administratorLow Agent reads the recordRead scope narrowed to the record in question rather than the surrounding objectAgent builderMedium Model follows stored textRole separation: a low-privilege step condenses outside text, a second step holding tools acts only on the structured resultPlatform teamHigh Data departsA strict outbound allowlist, audited for lapsed and unjustified entries, with alerting on any unlisted destinationNetwork or securityLow Cutting the last step costs the least, and it is where the vendor's own mitigation landed. The third step is the expensive one, and nobody is positioned to promise it has been closed. Detection of planted text, by itself, is not something to build a design around. For the broader pattern, see [prompt injection defence for production agents](/prompt-injection-defense-techniques-production-agents) and [why least privilege gets harder with agents](/least-privilege-harder-with-ai-agents). ## Can a Classifier Spot the Planted Sentence? The table above puts role separation in the expensive column and leaves detection out of the design altogether. That is not a hunch, and the published work is worth reading before anybody funds a filter. In a paper accepted at ACL 2025, first posted in February of that year and revised in October, Yulin Chen together with six co-authors built a benchmark for precisely this question across two question-answering sets of 900 samples each, and [found that existing models struggle to reliably detect indirect prompt injection](https://arxiv.org/abs/2502.16580). The spread in those measurements is the part a security team should sit with. One widely deployed instruction-tuned model averaged a little under 79 per cent accuracy on the first set, a second averaged in the low forties, and a purpose-built guard model topped out below 40 per cent, [on the authors' own figures](https://arxiv.org/abs/2502.16580). Detectors the researchers trained on their own crafted data scored far higher, into the high nineties, but the same paper records those models over-defending on clean out-of-domain documents. In a CRM that failure mode is an assistant that declines to summarise ordinary leads, which is how a control gets switched off by the business rather than by an attacker. The reference documents land in the same place using policy language. The OWASP entry for prompt injection says plainly that it is ["unclear if there are fool-proof methods of prevention"](https://genai.owasp.org/llmrisk/llm01-prompt-injection/), and it lists segregating and marking external content alongside least privilege and human approval for high-risk actions rather than ahead of them. Its companion cheat sheet is blunter about what a label actually buys: ["labeling alone does not enforce that boundary"](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html), and proposed tool arguments belong in execution code where the caller's permissions get checked, never in a prompt. Two items from that cheat sheet map onto this chain directly and cost close to nothing. Put the test text in the external channel rather than the user message, which for this shape means a lead record is where your probe goes. Then [check whether dummy data reaches an instrumented destination you control](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html), which tests the fourth link live instead of reviewing the allowlist file and hoping. ## Detection Is a Monitoring Feature, Not a Boundary This is where we part company with how most teams appear to be spending. The instinct after a disclosure of this shape is to buy something that reads incoming text and flags the hostile sentence, because that feels like stopping the attack at the door. On the published evidence it does not stop it, it reports on it. A boundary either holds or it is not a boundary, and a classifier that [misses a meaningful share of planted instructions on a benchmark built for the purpose](https://arxiv.org/abs/2502.16580) is a monitoring signal wearing a boundary's job title. The ordering we would defend is the unglamorous one. Fix what the agent is allowed to read and where it is allowed to send data first, because both are deterministic and a security team can prove their state on a Tuesday afternoon without a model in the loop. Add the classifier afterwards, wired to an alert rather than a block, and treat every hit as an instruction to go and look at the record a human wrote into. Spend on the egress allowlist and the read scope before anyone opens a procurement document for injection detection. Only one thing moves this call: a detector with an independently reproduced miss rate low enough to carry an authorisation decision, measured against adversarial text nobody trained it on, and a false-alarm rate a sales organisation would actually tolerate. Nothing published clears both halves yet. The day something does, detection graduates from monitoring to control, and this ordering should be inverted. ## The Monday Checklist - List every input a stranger can write into: public forms, inbound mail, portal tickets, calendar invitations, shared documents. Mark which of them land in a store an agent reads. - Per agent, enumerate every channel capable of moving data outward, including rendered images and references in its own output. - Walk the outbound allowlist end to end. Delete whatever nobody can justify, and check specifically for a registration that has been allowed to lapse. - Confirm that platform protections such as the vendor's trusted URL enforcement are actually enabled in your own tenant. A default is not a configuration. - Run a tabletop on this exact shape: text from a stranger, sitting in a record, steering an assistant toward disclosure. Which log entry exposes that, and whose job is it to read that log? - Set an alert for any triage agent reaching an external host that is not on its list. ## How to Brief the Three People Who Own the Links Say prompt injection in a meeting and most people picture somebody typing a clever sentence into a chat box. This chain is the other shape entirely, and the difference changes who has to care. The attacker never interacts with the agent. They deposit text somewhere the agent will eventually look, then wait for an employee to ask an entirely reasonable question. Three people hold one link each. The administrator who decides what a public form accepts. The builder who sets how much the agent can read. The owner of the egress policy. None of those three would describe themselves as working on AI security, and each can sever the chain alone. If every one of them assumes the problem belongs to somebody else, the chain stays intact, which is the normal outcome absent a conversation. A single-page diagram does more work here than any policy document. Sketch each field an outsider can write into, connect it to whichever assistants consume that field, and sketch every route by which those assistants can send something outward. Put a person's name on each connection. Any connection carrying no name gets one assigned this week. By itself the drawing prevents nothing, but it renders the radius visible, and it converts the next disclosure of this type into a short review instead of several days of uncertainty. ## Open Questions in the Record Several things the public record does not settle. Whether anyone used the chain against a real tenant before the mitigation shipped is unknown to us. The severity figure is the finder's rating and not one we independently verified. And beyond the coverage, no detailed technical statement from the vendor has been available to read. The class also reaches past a single product. [Reporting describes Zenity Labs showing a comparable pattern through crafted records against Salesforce Einstein, with the vendor stating a fix on 11 July 2025](https://the-decoder.com/agent-based-ai-systems-face-growing-threats-from-zero-click-and-one-click-exploits/). A different product, the same underlying idea. Our [EchoLeak analysis](/echoleak-zero-click-ai-agent-lessons) traces this class through an entirely unrelated stack. Three sentences hold the corrected model. Trust belongs to whoever wrote a given piece of text, and never to whichever system happens to store it. The channels an assistant can write out through belong in the same inventory as its tools, because they are equally part of its exposure. And the question worth putting to a design is not whether planted text can reach it, but what the thing can read and where it can send data once that text has landed. Nothing above is complete on its own; each item lowers likelihood or caps impact. ## Questions about stored-data injection against CRM agents ### What exactly was the ForcedLeak chain? A sequence of weaknesses in Salesforce Agentforce, published during September 2025 by the researchers at Noma Labs. Hidden directions carried inside a saved lead record could lead the assistant to send CRM data outward. A mitigation has shipped. ### What makes an injection indirect? The directions arrive inside material the assistant fetches, whether a saved record, a document or an inbound message, rather than inside anything a person typed into it. ### Does the patch remove the risk? A patch shuts the one route. The class carries on, so narrow what each assistant is able to read and tighten every path by which data departs. ### How does this differ from a direct injection? Somebody outside positions the text within stored data and never interacts with the assistant at all. A colleague sets it off later by asking something completely routine. ## FAQ ### What exactly was the ForcedLeak chain? A sequence of weaknesses in Salesforce Agentforce, published during September 2025 by the researchers at Noma Labs. Hidden directions carried inside a saved lead record could lead the assistant to send CRM data outward. A mitigation has shipped. ### What makes a prompt injection indirect? The directions arrive inside material the assistant fetches, whether a saved record, a document or an inbound message, rather than inside anything a person typed into it. ### Does the patch remove the risk? A patch shuts the one route. The class carries on, so narrow what each assistant is able to read and tighten every path by which data departs. ### How does this differ from a direct injection? Somebody outside positions the text within stored data and never interacts with the assistant at all. A colleague sets it off later by asking something completely routine. --- Source: https://agenticcyber.co/blog/forcedleak-lessons-indirect-prompt-injection-against-crm-agents