ForcedLeak Exposes Critical Prompt Injection Flaw in AI-Powered CRM Systems

Security researchers at Noma Security have disclosed a critical vulnerability dubbed ForcedLeak that exposes a fundamental weakness in AI-powered customer relationship management platforms. With a CVSS severity score of 9.4, the exploit demonstrates how attackers can exfiltrate sensitive business data from enterprise AI agents for as little as five dollars — the cost of registering an expired domain name.

The Exploit Mechanics

The attack targets Salesforce Agentforce, a platform that enables organizations to build and deploy AI agents for sales and customer service workflows. The vulnerability exploits a core limitation of large language models: the inability to distinguish between legitimate data and embedded malicious instructions. An attacker submits a Web-to-Lead form with a hidden prompt injection payload in the Description field. When an internal employee processes the lead using a standard AI-powered query, Agentforce executes both the legitimate request and the concealed malicious instructions simultaneously. The compromised agent then queries the CRM database for sensitive lead information — names, email addresses, revenue data — and exfiltrates it to an attacker-controlled domain disguised as a PNG image request.

Affected Systems

The exploit specifically impacts Salesforce Agentforce when configured with Web-to-Lead functionality, a feature widely used by sales organizations to capture and route incoming prospect information. The attack leverages an expired Salesforce-related domain that remained on the system’s URL allowlist. While Salesforce moved quickly to re-secure the expired domain and enforce URL allowlist validation, the underlying architectural vulnerability persists across any system that processes untrusted input through large language models. As Bitcoin trades above $114,000 and the broader crypto ecosystem increasingly integrates AI agents for trading and portfolio management, similar prompt injection vectors pose significant risks to decentralized platforms that rely on LLM-powered smart contract interactions.

The Mitigation Strategy

Salesforce implemented immediate remediation by re-securing the compromised domain and tightening URL allowlist enforcement to prevent data exfiltration through untrusted endpoints. However, security experts emphasize that these measures address only the specific attack technique, not the root cause. Effective mitigation requires fundamental changes to how AI agents process context windows. Organizations should implement strict input sanitization that separates data from instructions at the architectural level, deploy output monitoring systems that flag anomalous data access patterns, and enforce least-privilege access controls that limit what AI agents can query even when compromised. Ethereum at $4,146 and Solana at $208 reflect a market where institutional capital flows are increasingly managed by AI agents, making robust prompt injection defenses critical infrastructure.

Lessons Learned

ForcedLeak reveals a sobering truth about the current state of AI security: the most sophisticated AI systems remain vulnerable to attacks that exploit their fundamental architecture rather than software bugs. The vulnerability is not a buffer overflow or a SQL injection — it is a characteristic of how transformer-based models process information. Instructions and data occupy the same context window and are processed through identical mechanisms. This lesson extends directly to the crypto industry, where AI agents are being deployed for autonomous trading, yield farming optimization, and cross-chain bridge operations. A single prompt injection in a DeFi agent could redirect funds, manipulate oracle data, or compromise private key management. The Model Context Protocol, an emerging standard for multi-agent coordination, amplifies these risks by enabling compromised agents to propagate malicious instructions across interconnected systems.

User Action Required

Organizations deploying AI agents — whether for CRM, crypto trading, or DeFi operations — must immediately audit their input validation pipelines. Deploy input-output separation layers that treat all external data as potentially hostile. Implement real-time monitoring for anomalous agent behavior, particularly unexpected data queries or outbound network requests. For crypto platforms specifically, ensure that AI agents handling financial transactions operate within sandboxed environments with hardcoded transaction limits and mandatory human confirmation for transfers exceeding predefined thresholds. The cost of prevention is negligible compared to the cost of a single successful exfiltration attack.

Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult qualified professionals before making security decisions.