Incident: A trusted domain anyone could buy

Module 12 · Incident file · About 30 minutes

What happened

On 25 September 2025 Sasi Levi of Noma Security published "ForcedLeak: AI agent risks exposed in Salesforce Agentforce". Noma Labs had found "a critical severity (CVSS 9.4) vulnerability chain" that "could enable external attackers to exfiltrate sensitive CRM data through an indirect prompt injection attack". Agentforce is Salesforce's agent for its customer relationship management (CRM) system.

The way in was Web-to-Lead, a public form that lets "website visitors, conference attendees, or prospects" submit their details straight into the CRM. Its Description field takes 42,000 characters, and Noma put instructions there. Later an employee asks the agent something routine about that lead. The agent reads the lead, follows the instructions, looks up other leads' email addresses and writes them into an image link. When the image loads, the data goes to the attacker's server.

The link only worked because of one line in Salesforce's Content Security Policy, the list of hosts a page may load images from. In Noma's words: "The domain my-salesforce-cms.com was whitelisted but had expired and become available for purchase." The researchers bought it for $5.

Noma reported it on 28 July 2025. On 8 September Salesforce began enforcing "Trusted URLs" for Agentforce and Einstein AI, and it "re-secured the expired whitelist domain". Jessica Lyons of The Register reported on 26 September that Salesforce "declined to answer The Register's questions about ForcedLeak, including whether the flaw was abused and sensitive data disclosed". What is published is a researcher's proof of concept, not a confirmed breach.