Security researchers at Noma Security have disclosed a critical vulnerability dubbed ForcedLeak that exposes a fundamental weakness in AI-powered customer relationship management platforms. With a CVSS severity score of 9.4, the exploit demonstrates how attackers can exfiltrate sensitive business data from enterprise AI agents for as little as five dollars — the cost of registering an expired domain name.
The Exploit Mechanics
The attack targets Salesforce Agentforce, a platform that enables organizations to build and deploy AI agents for sales and customer service workflows. The vulnerability exploits a core limitation of large language models: the inability to distinguish between legitimate data and embedded malicious instructions. An attacker submits a Web-to-Lead form with a hidden prompt injection payload in the Description field. When an internal employee processes the lead using a standard AI-powered query, Agentforce executes both the legitimate request and the concealed malicious instructions simultaneously. The compromised agent then queries the CRM database for sensitive lead information — names, email addresses, revenue data — and exfiltrates it to an attacker-controlled domain disguised as a PNG image request.
Affected Systems
The exploit specifically impacts Salesforce Agentforce when configured with Web-to-Lead functionality, a feature widely used by sales organizations to capture and route incoming prospect information. The attack leverages an expired Salesforce-related domain that remained on the system’s URL allowlist. While Salesforce moved quickly to re-secure the expired domain and enforce URL allowlist validation, the underlying architectural vulnerability persists across any system that processes untrusted input through large language models. As Bitcoin trades above $114,000 and the broader crypto ecosystem increasingly integrates AI agents for trading and portfolio management, similar prompt injection vectors pose significant risks to decentralized platforms that rely on LLM-powered smart contract interactions.
The Mitigation Strategy
Salesforce implemented immediate remediation by re-securing the compromised domain and tightening URL allowlist enforcement to prevent data exfiltration through untrusted endpoints. However, security experts emphasize that these measures address only the specific attack technique, not the root cause. Effective mitigation requires fundamental changes to how AI agents process context windows. Organizations should implement strict input sanitization that separates data from instructions at the architectural level, deploy output monitoring systems that flag anomalous data access patterns, and enforce least-privilege access controls that limit what AI agents can query even when compromised. Ethereum at $4,146 and Solana at $208 reflect a market where institutional capital flows are increasingly managed by AI agents, making robust prompt injection defenses critical infrastructure.
Lessons Learned
ForcedLeak reveals a sobering truth about the current state of AI security: the most sophisticated AI systems remain vulnerable to attacks that exploit their fundamental architecture rather than software bugs. The vulnerability is not a buffer overflow or a SQL injection — it is a characteristic of how transformer-based models process information. Instructions and data occupy the same context window and are processed through identical mechanisms. This lesson extends directly to the crypto industry, where AI agents are being deployed for autonomous trading, yield farming optimization, and cross-chain bridge operations. A single prompt injection in a DeFi agent could redirect funds, manipulate oracle data, or compromise private key management. The Model Context Protocol, an emerging standard for multi-agent coordination, amplifies these risks by enabling compromised agents to propagate malicious instructions across interconnected systems.
User Action Required
Organizations deploying AI agents — whether for CRM, crypto trading, or DeFi operations — must immediately audit their input validation pipelines. Deploy input-output separation layers that treat all external data as potentially hostile. Implement real-time monitoring for anomalous agent behavior, particularly unexpected data queries or outbound network requests. For crypto platforms specifically, ensure that AI agents handling financial transactions operate within sandboxed environments with hardcoded transaction limits and mandatory human confirmation for transfers exceeding predefined thresholds. The cost of prevention is negligible compared to the cost of a single successful exfiltration attack.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult qualified professionals before making security decisions.
anyone else testing expired domain attacks now
the Web-to-Lead form in Salesforce has zero input validation before passing to Agentforce. who architected this
5 dollar attack cost using an expired domain. the ROI on this exploit is astronomical. every AI agent touching CRM data needs input validation at the model layer not just the form layer
5 dollar attack cost to exfiltrate enterprise CRM data through an expired domain. the economics of AI security exploits are genuinely terrifying
CVSS 9.4 for a 5 dollar expired domain attack. the asymmetry is insane. pentesters must be having a field day with LLM agents
var_int_ a 5 dollar expired domain and a CVSS 9.4. pentesters must be laughing all the way to the bank with LLM agent exploits
var_int_ the asymmetry of a 5 dollar expired domain attack against a CVSS 9.4 is the entire prompt injection problem in one sentence. defense costs millions, offense costs lunch
This ForcedLeak vulnerability is exactly why we need to move toward decentralized AI frameworks. If a simple prompt injection can dump a whole CRM database, the centralized trust model is officially broken. Honestly, it makes me wonder if these enterprise AI tools are even ready for production yet.
Salesforce Agentforce processing hidden payloads from a Web-to-Lead form field. who approved that architecture review
var_int_ expired domain attacks are underrated. OSINT community has been warning about this for years but enterprise security still ignores it
Lmao, prompt injection is basically the new SQLi. These CRM systems are getting rekt because they trust user input way too much. Not your weights, not your data! Until we get some solid encryption layers between the LLM and the backend, this is just going to keep happening. Stay safe out there guys.
Satoshi_Stacy the comparison to SQLi is spot on. same root cause too: trusting unsanitized user input. we solved this in web dev 15 years ago but apparently AI teams skipped that class
SQLi comparison is spot on. same root cause: trusting unsanitized user input. we solved this for web apps 15 years ago but AI teams apparently skipped that chapter
input_sanitizer solved this for web apps 15 years ago with parameterized queries. AI teams literally repeating history
input_sanitizer parameterized queries killed SQLi because the fix was deterministic. prompt isolation doesnt have an equivalent yet. every LLM handles instructions differently
Interesting breakdown of the ForcedLeak exploit. I’ve been saying for months that AI-powered CRMs are a massive privacy risk for corporations. The speed at which these tools are being shipped is ignoring basic security protocols. We really need better sandboxing for these model interactions before the next major leak hits.
prompt injection in crm systems was only a matter of time
the Web-to-Lead form is the attack vector nobody talks about. every marketing team enables it without thinking about LLM ingestion risks
salesforce agentforce cvss 9.4 from a 5 dollar domain is too easy
Sahil V. Web-to-Lead has been the default Salesforce intake for 15 years. nobody in marketing ever considered that a form field could own their AI agent
expired domain for 5 bucks and you own the exfiltration endpoint. supply chain attacks dont need zero days anymore, just a GoDaddy clearance sale
CVSS 9.4 and Salesforce probably patched it by adding a disclaimer to the docs. enterprise AI security is theater at this point
a Web-to-Lead form with zero validation passing straight to an AI agent that has database access. who signed off on this architecture