Loading story…
A critical vulnerability known as ForcedLeak was discovered in Salesforce Agentforce, an AI-driven CRM automation platform, allowing attackers to exfiltrate sensitive customer data through indirect prompt injection. Researchers at Noma Security identified that the flaw could be exploited via the Web-to-Lead feature, where malicious instructions embedded in form fields tricked the AI agent into leaking confidential CRM information. The attack enabled threat actors to transmit data such as customer contacts, sales pipeline details, and internal communications to attacker-controlled domains by leveraging weaknesses in context validation and content security policies. Salesforce has since patched the vulnerability, which was rated CVSS 9.4, after coordinated disclosure. The incident highlights the expanded attack surface introduced by autonomous AI agents compared to traditional prompt-response systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent analysis and podcast commentary revisited the Salesforce Agentforce incident as an example of prompt-injection risk in enterprise AI systems. These later references did not introduce a new breach or victim, but reinforced the significance of the earlier disclosure and patching.
Multiple outlets publicly disclosed technical details of the ForcedLeak issue, explaining that prompt injection against Salesforce Agentforce could force AI agents to reveal sensitive customer or CRM information. The reporting framed the bug as a serious AI-agent security weakness with real data-compromise potential.
Salesforce released a patch for the critical Agentforce vulnerability after the issue was reported. Coverage says the flaw could expose or exfiltrate CRM data through manipulated AI agent interactions and that remediation was made available by the time of disclosure.
Security researchers identified a vulnerability dubbed "ForcedLeak" in Salesforce Agentforce that could coerce AI agents into leaking sensitive CRM data via prompt injection. Reports describe the attack as using attacker-controlled content, including a low-cost domain and Web-to-Lead style inputs, to influence the agent's behavior.
13 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcegrahamcluley.com
Open sourcenoma.security
Open sourcesecurityaffairs.com
Open sourcehackread.com
Open sourcethehackernews.com
Open sourceinfosecurity-magazine.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zenity Labs disclosed three now-patched **SalesBleed** vulnerabilities in Salesforce Agentforce that allowed attackers to plant indirect prompt injections through public Salesforce Web-to-Lead forms. When an employee later asked Agentforce about a seemingly legitimate lead, hidden instructions in the poisoned record could direct the General CRM subagent to retrieve other CRM records available under its existing permissions, without requiring the employee to click or approve an action. The researchers demonstrated exfiltration through DNS requests initiated by externally sourced HTML image URLs after bypassing Agentforce's Trusted URLs redaction safeguards; Slack link unfurling also contributed to the data-leak chain. A separate flaw in Slack-thread replies enabled Agentforce to send messages without confirmation or visible attribution, allowing anonymous phishing as the trusted agent. Salesforce remediated the reported issues, with Zenity confirming the final fixes on September 21.
Sep 25, 2026
Researchers disclosed critical weaknesses in **Salesforce Marketing Cloud** (formerly ExactTarget) that could have allowed cross-tenant exposure of subscriber data, sent emails, SMS records, click tracking, and other marketing data. AMPScript and SSJS template-injection paths could query unrestricted Data Views, while legacy encrypted query strings used by email-view, Cloud Pages, and Forward-to-a-Friend features were vulnerable to CBC padding-oracle and obsolete XOR-based cryptographic attacks, enabling parameter decryption and forgery. Salesforce replaced the affected protection with AES-GCM, expired links generated before January 23, 2026, and disabled double evaluation of AMPScript in email subject lines; it said it found no confirmed unauthorized access or misuse tied to the issues. Separate research documented how an exposed Uber testing endpoint for Salesforce ExactTarget previously let authenticated users submit arbitrary AMPScript through a preview function. The flaw permitted queries against Uber’s `driver_partners` data extension, returning driver UUIDs, join dates, email addresses, and first names, and allowed outbound HTTP GET requests through ExactTarget infrastructure. Assetnote reported that issue in November 2017, Uber remediated it within two days, and the report earned a total HackerOne bounty of $23,000.
Sep 3, 2026
A coordinated wave of cyberattacks in 2025 targeted organizations using Salesforce’s CRM platform, resulting in significant data breaches at major companies including Google and Workday. Attackers exploited the inherent trust and connectivity of cloud-based CRM systems, focusing on social engineering rather than technical vulnerabilities. Workday confirmed that attackers accessed a database containing business contact information for up to 11,000 corporate customers and 70 million individual user records, with the breach discovered in early August 2025. Google also disclosed that its Salesforce instance used for Google Ads leads was compromised, leading to the theft of over 2.5 million customer records, including business contact details and sales notes for small and mid-sized clients. Cisco and other organizations were also listed among the victims of this campaign. The threat group responsible, identified as UNC6040 and associated with ShinyHunters, used telephone-based social engineering (vishing) to trick employees into granting access or sharing credentials. Attackers convinced targets to use a modified, unauthorized version of the Salesforce Data Loader app, which enabled them to exfiltrate sensitive data from Salesforce environments. Mandiant, working with Google, provided proactive defense recommendations, emphasizing that the attacks did not exploit Salesforce vulnerabilities but rather relied on manipulating end users. The attackers’ tactics included delayed extortion demands, sometimes occurring months after the initial compromise. The breaches highlighted the risks of interconnected cloud services and the importance of robust identity and access management. Security experts stressed the need for organizations to harden their Salesforce and other cloud assets against social engineering. The incidents underscored the growing trend of targeting SaaS platforms through human factors rather than technical flaws. Lessons from these breaches include the necessity of employee training, multi-factor authentication, and vigilant monitoring of third-party integrations. The scale and sophistication of the attacks demonstrated the evolving threat landscape for cloud-based business applications. Organizations are urged to review their incident response plans and ensure that all users are aware of the risks posed by social engineering campaigns. The breaches serve as a warning for enterprises to reassess their security posture around cloud CRM platforms and to implement layered defenses against both technical and human-centric threats.
Jun 29, 2026