{
 "id": "TR-2026-001",
 "status": "published",
 "title": "ForcedLeak: a poisoned Web-to-Lead form turns Salesforce Agentforce into a data-exfiltration channel",
 "date": "2025-09-25",
 "window": "Disclosed 25 Sep 2025; fixed by Salesforce in the same window",
 "ai_role": "target",
 "category": "red_team",
 "summary": "Researchers showed that instructions placed in a public Web-to-Lead form field are later read by an Agentforce agent processing the lead, which queries CRM lead records and sends them to an attacker-controlled domain that was still on Salesforce's content allowlist because it had expired and been re-registered. CVSS 9.4. Salesforce enforced Trusted URL allowlists for Agentforce and Einstein AI and re-secured the domain.",
 "attacker": {
  "description": "Security researchers (Noma Security), proof of concept"
 },
 "defender": {
  "description": "Salesforce — patched after coordinated disclosure"
 },
 "scale": "CRM lead data reachable to the agent; no in-the-wild exploitation reported",
 "impact": "Exfiltration of lead records an employee asked the agent about",
 "tactics": [
  "TA0001",
  "TA0005",
  "TA0009",
  "TA0010"
 ],
 "timeline": [
  {
   "date": "2025-09-25",
   "text": "Noma Security discloses ForcedLeak; Salesforce has patched (Trusted URL allowlists) and re-secured the expired allowlisted domain",
   "tier": 2,
   "source": "1"
  }
 ],
 "lessons": [
  "Any field an agent will later read is an injection surface — treat untrusted CRM/form content as hostile input, not data.",
  "An allowlist of 'trusted' egress domains fails when one lapses and is re-registered; verify ownership, not just the string.",
  "Keep a human approval gate between an agent and any outbound send during a pilot."
 ],
 "models_named": [],
 "related_agents": [
  "salesforce-salesforce-agentforce",
  "salesforce-agentforce-financial-services",
  "salesforce-agentforce-insurance",
  "salesforce-salesforce-government-cloud-agentforce"
 ],
 "vendor_response": "Salesforce patch (Trusted URLs enforcement), September 2025",
 "sources": [
  {
   "title": "Salesforce Patches Critical ForcedLeak",
   "url": "https://thehackernews.com/2025/09/salesforce-patches-critical-forcedleak.html",
   "outlet": "The Hacker News",
   "date": "2025-09-25"
  }
 ],
 "reviewer": null,
 "checked_on": null
}