Executive Summary
Vulnerabilities in Salesforce Agentforce let attackers plant indirect prompt injection in CRM data through a public Web-to-Lead form; when an employee later queried leads, the agent followed the instructions and exfiltrated customer data without an extra click.
What Happened
The Register reports that vulnerabilities in Salesforce Agentforce could let attackers use a public Web-to-Lead form to insert indirect prompt injection into CRM data. When an employee later queried leads, the Agentforce agent could process the malicious instructions and exfiltrate sensitive customer information without a separate user click.
Affected Products
- Salesforce Agentforce
- Salesforce Web-to-Lead
Vulnerability / Attack Technique
Zero-click indirect prompt injection via a public lead form
Technical Mechanism
An attacker submits a lead containing hidden instructions; later, an Agentforce query over leads processes that text as instructions and sends sensitive customer data out.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Any public form that feeds data an agent later reads is an injection point. RealGround analysis: map every path where untrusted input reaches an agent's context, including stored records.
Recommended Controls
- Treat CRM fields from public forms as untrusted when agents read them
- Restrict agents' ability to send data to external destinations
- Apply Salesforce's fixes and review Agentforce permissions
- Test agents with injection payloads stored in business records
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.