Agentforce Agentic AI Tool Was Exposed to Indirect Prompt Injection Attacks
Salesforce patched a vulnerability involving its Agentforce agentic artificial intelligence tool that would have allowed attackers to steal customer data and leads being stored in the CRM system.
See Also: When Identity Protection Fails: Rethinking Resilience for a Modern Threat Landscape
A report from AI security platform vendor Noma Labs details a chain of indirect prompt injection vulnerabilities it discovered and dubbed ForcedLeak. Researchers reported the flaw to the CRM giant on July 28, calculating that it would have a CVSS-equivalent score of 9.4.
Salesforce said it investigated the vulnerability and put fixes in place by Sept. 8 for its Agentforce agentic AI toolbuilder as well as its Einstein generative AI tool.
“Salesforce is aware of the vulnerability reported by Noma and has released patches that prevent output in Agentforce agents from being sent to untrusted URLs,” a spokesperson told Information Security Media Group. “The security landscape for prompt injection remains a complex and evolving area, and we continue to invest in strong security controls.”
Salesforce describes Agentforce as being an “agent builder” designed to create AI agents able to handle a variety of tasks, without needing human input. The functionality serves as an agentic AI layer that can interface with any aspect of the Salesforce platform.
“These intelligent agents can include anything from answering simple questions to resolving complex issues – even multi-tasking,” Salesforce said. “Most importantly, they can continuously improve their own performance through self-learning. This is distinct from traditional AI, which requires human input for specific tasks.”
Exploiting autonomous Agentforce AI agents using an indirect prompt injection required researchers to take several steps.
“We enabled Salesforce’s Web-to-Lead feature, which allows external users – such as website visitors, conference attendees or prospects – to submit lead information that directly integrates with the CRM system,” Noma Labs said. “This feature is commonly used at conferences, trade shows and marketing campaigns to capture potential customer information from external sources.”
The researchers found that Salesforce’s Web-to-Lead form features a “description” field with a 42,000 character limit, into which they could inject a malicious payload, in the form of hidden instructions, telling Agentforce to gather a range of sensitive data and send it to a designated server. After the system processed the lead data, it would do just that, sending the sensitive information to an attacker-controlled server.
“The LLM, operating as a straightforward execution engine, lacked the ability to distinguish between legitimate data loaded into its context and malicious instructions that should only be executed from trusted sources, resulting in critical sensitive data leakage,” Noma Labs said.
Normally, this type of attack would have been blocked by Salesforce’s Content Security Policy, the researchers said. When studying that policy, they found that it whitelisted the domain my-salesforce-cms.com, over which Salesforce had neglected to retain ownership, resulting in it becoming available for anyone to register. The researchers did so for $5 and gained a whitelisted exfiltration channel allowing their data-exfiltration proof-of-concept attack to succeed.
“Salesforce has re-secured the expired whitelist domain, mitigating risk of potential exfiltration,” the researchers said, and “also implemented additional security controls.”
These controls, Salesforce said, include a new trusted URL allowlist for Agentforce and Einstein designed “to ensure no malicious links are called or generated through potential prompt injection” by blocking the tools from calling or generating any external content. This includes any workflows with links to external documentation or systems, any workflows with an agent response that includes an unapproved URL, as well as workflows “that generate images or rich content from external, non-Salesforce domains,” it said.
As a workaround, Salesforce said, customers can add external URLs to a trusted URL list that will apply across their Salesforce org permissions.
Indirect Prompt Injection Risks
Indirect prompt injection attacks are a repeat problem for many AI tools, especially as vendors add agentic capabilities designed to act without user input.
“The disclosure of this vulnerability shows us the vastness of the attack surface that new and emerging technologies have,” said Mayuresh Dani, security research manager at Qualys.
Fresh features can mean new potential threat vectors. “As Peter Parker’s wise Uncle Ben said: ‘With great power comes great responsibility,'” said Diana Kelley, CISO of Noma, in a post to LinkedIn.
“The great power and promise of autonomous agentic AI systems can only be realized if we understand and manage the responsibilities that go with that autonomy,” Kelley said. Google in June announced it would be adding new defenses to its Gemini LLM after a researcher discovered a way to trick it into delivering deceptive messages to end users when they requested a summary of their unread emails (see: Summarizing Emails With Gemini? Beware Prompt Injection Risk).
“Unlike direct prompt injections, where an attacker directly inputs malicious commands into a prompt, indirect prompt injections involve hidden malicious instructions within external data sources,” Google said at the time. “These may include emails, documents or calendar invites that instruct AI to exfiltrate user data or execute other rogue actions.”
“Prompt injections are the new email macros,” said Marco Figueroa, GenAI bug bounty programs manager at 0Din, at the time. 0Din, a generative artificial intelligence bug bounty platform launched by Mozilla in 2024, coordinated the Gemini bug report.
“Until LLMs gain robust context-isolation, every piece of third-party text your model ingests is executable code. Security teams must treat AI assistants as part of the attack surface and instrument them, sandbox them and never assume their output is benign,” Figueroa said.