New Salesforce AI agent vulnerability enables data compromise

Autonomous artificial intelligence agent platform for customer relationship management Salesforce Agentforce has been impacted by the critical ForcedLeak vulnerability, which could have been exploited to expose private CRM data via indirect prompt injections, according to HackRead.

Threat actors could target AgentForce's often-activated Web-to-Lead functionality to inject nefarious code in a large input field that would force the exfiltration of CRM data, including email addresses, sales pipeline information, and historical records, to an external server, a report from Noma Security showed.

Data compromise could also be facilitated by the abuse of systems' outdated Content Security Policy. Fixes for the issue were promptly issued following disclosure by Noma researchers, with Salesforce urging the immediate implementation of Trusted URLs for Agentforce and Einstein AI, as well as the auditing of available lead information.

Additional safeguards have also been advised by Black Duck Senior Cybersecurity Solution Architect Chrissa Constantine.

"It's advisable to secure the systems around the AI agents in use, which include APIs, forms, and middleware, so that prompt injection is harder to exploit and less harmful if it succeeds," Constantine added.