Executive Summary
Varonis describes ForcedLeak, a critical vulnerability chain in Salesforce Agentforce enabling silent CRM data theft via indirect prompt injection, agent overreach and a content security policy misconfiguration.
What Happened
Varonis describes ForcedLeak as a critical vulnerability chain in Salesforce Agentforce that enables silent CRM data theft via indirect prompt injection, agent overreach, and content security policy misconfiguration.[10] The exploit allows attackers to use crafted prompts to manipulate the agent into exfiltrating sensitive customer relationship data while bypassing standard access controls.[10]
Affected Products
- Salesforce Agentforce
Vulnerability / Attack Technique
Indirect prompt injection combined with CSP misconfiguration
Technical Mechanism
Injected prompts manipulate the agent into sending CRM data out, and a permissive CSP allowed the exfiltration channel.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
The exfiltration worked because of a web configuration gap as well as the agent. RealGround analysis: classic web controls like CSP remain part of AI agent security.
Recommended Controls
- Tighten CSP and allowed domains for agent-rendered content
- Apply Salesforce's fixes
- Restrict agent access to sensitive CRM fields
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
Varonis: https://www.varonis.com/blog/forcedleak
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.