What Happened
The Register reports that vulnerabilities in Salesforce Agentforce could let attackers use a public Web-to-Lead form to insert indirect prompt injection into CRM data. When an employee later queried leads, the Agentforce agent could process the malicious instructions and exfiltrate sensitive customer information without a separate user click.
Why It Matters
The report describes Salesforce Agentforce vulnerabilities in which attackers could submit malicious instructions through a public Web-to-Lead form, causing the agent to process indirect prompt injection when an employee later queried CRM leads. Researchers reported that the flaws could enable zero-click exfiltration of sensitive CRM data and phishing through the agent’s trusted identity. RealGround analysis: the incident highlights the need to audit agent data flows, constrain tool permissions and outbound destinations, and continuously red-team untrusted CRM inputs and agent actions.
RealGround Analysis
This signal maps to indirect prompt injection. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.