Inherited Agents: Public Intake Forms as an Agentforce Instruction Channel

Key Takeaways

Enterprises that enable an AI agent on top of an existing CRM inherit every public intake path that already writes into that CRM. A web form that was designed to collect a name and a message becomes, once an agent reads the resulting record, a channel through which an anonymous party can address the agent. Two independently published research chains against Salesforce Agentforce, ForcedLeak in 2025 [1][2] and PipeLeak in April 2026 [3][4], followed this same path and, in the researchers’ demonstrations, ended in exfiltration of CRM data.

The vendor fixes published so far address specific scenarios rather than the underlying condition. Salesforce began enforcing Trusted URL allow-lists by September 8, 2025, which closed the demonstrated exfiltration destination [5]. For PipeLeak, Salesforce said it had “remediated the specific scenario described,” while the researchers reported that the email channel remained exploitable on Custom Topics after retesting [4]. The two parties’ accounts differ, and this note does not resolve that disagreement.

The practical conclusion is that the review boundary for an agent deployment should include every system that can write to the data the agent reads. Organizations should inventory intake features that feed agent-visible records, treat free-text fields from those features as untrusted instructions-in-waiting, and constrain what the agent can send out regardless of what it has been told.

Background

Salesforce Agentforce is the company’s platform for building and deploying AI agents that act on CRM data and invoke configured actions, such as querying records or sending email. Many deployments are layered on top of long-standing intake features. Web-to-Lead, for example, generates an HTML form that any website visitor can submit, and each submission becomes a Lead record in the CRM. These features predate agents and were built on the assumption that a human employee would read the record and decide what to do with it.

That assumption no longer holds once an agent summarizes, triages, or acts on the same record. The agent places the stored text in its context window alongside the employee’s request, and current language models offer no reliable architectural guarantee of distinguishing data from instruction within that context. CSA’s whitepaper on prompt injection in agentic pipelines treats this as a structural property of the model rather than a defect in any one product [12]. The term “inherited agents” is used in this note for deployments where the agent arrives as an add-on to an existing system, and where the attack surface is therefore defined by a legacy intake design that nobody revisited when the agent was enabled.

ForcedLeak (2025)

Noma Security reported the ForcedLeak chain to Salesforce on July 28, 2025, and assigned it a CVSS score of 9.4 [1][5]. The researchers noted that most Web-to-Lead fields carried restrictive limits of 40 to 80 characters, while the Description field accepted 42,000 characters, enough to hold a multi-step instruction set [5]. When an employee later asked Agentforce to process the lead, the agent read the attacker’s text along with the employee’s request and followed both [1][2][6].

Exfiltration relied on a second weakness. The Content Security Policy for Agentforce listed a Salesforce-associated domain, my-salesforce-cms.com, that had expired; the researchers bought it for about $5 and used it as the destination for stolen data [5]. Salesforce stated that it had released patches that prevent output in Agentforce agents from being sent to untrusted URLs, and it declined to confirm whether the flaw had been exploited in the wild [5]. The patch enforced Trusted URL allow-lists by September 8, 2025 [5]; Varonis likewise describes patches enforcing Trusted URLs [6].

PipeLeak (2026)

In April 2026, Capsule Security published PipeLeak, which it described as a prompt injection in Agentforce reachable through a public lead form with no authentication [3][4]. In Capsule’s testing, a payload placed in the form caused the agent, when an internal user asked it to review the lead, to query CRM records and send the results by email. Capsule’s CEO said the researchers “did not get to any limitation” on how much data could be pulled, and that the employee who triggered the agent received no indication that data had left the organization [4].

Salesforce characterized the scenario as configuration-specific, pointed to human-in-the-loop confirmation that it says is enabled by default for email-based agentic actions, and said it had remediated the specific scenario [3][4]. Capsule disputed that this resolves the issue, reporting unchanged behavior on retest for Custom Topics, which it described as the majority of enterprise deployments [4]. No CVE had been assigned as of the coverage cited here [3][4]. These are vendor and researcher claims that this note has not independently reproduced.

Security Analysis

The intake-to-prompt chain

The two disclosures share a common structure, shown below. Each step is individually ordinary, and the risk arises from their composition.

The stored, deferred nature of the attack matters for defenders. The attacker does not need to be present when the agent runs, and the person who triggers it has done nothing unusual. Detection that looks for suspicious behavior by the requesting user would likely see nothing unusual.

Why field-level limits and content filters offer limited protection

The 42,000-character Description field was what made ForcedLeak practical [5], but in the authors’ assessment shortening one field offers limited protection. Short fields can still carry instructions, and an agent that reads many fields in sequence can be addressed through any of them. Content classifiers that look for known injection phrasing also face the difficulty that benign-looking prose can carry an instruction [12]. Salesforce’s Einstein Trust Layer includes a prompt injection detection setting [7], which adds a layer of defense, but a classifier is a probabilistic control and should not be the only barrier between public text and CRM exfiltration.

In the authors’ assessment, a more durable approach is to break one of the conditions that make the attack work. Simon Willison’s “lethal trifecta” [13] holds that an agent is at risk when it combines access to private data, exposure to untrusted content, and the ability to communicate externally. An Agentforce agent that reads Lead records, ingests Web-to-Lead text, and can send email or render outbound links meets all three. Removing any one leg, and in particular the external communication leg, is intended to prevent exfiltration even if injection still succeeds.

Allow-listing closes a path, and does not close the class

Trusted URL enforcement addresses one egress route: it prevents the agent from emitting links or requests to domains outside an approved list [5]. ForcedLeak also illustrated the maintenance burden of such lists, since an expired domain on a trusted list became an attacker-controlled destination [5]. PipeLeak used a different route, outbound email [4], which URL enforcement would not be expected to address. The pattern suggests that egress controls need to be defined by capability (which recipients, which volume, which data classes) rather than by enumerating the particular destinations used in published proofs of concept.

Human-in-the-loop is a partial answer

Salesforce points to confirmation prompts for email actions [4]. Confirmation can help when the approver sees the full content of the outbound message and its recipient. Capsule’s CEO argued that if staff must approve every action, the agent provides little automation [4]. Approval fatigue is a plausible further risk with human-confirmation controls, though this is the authors’ inference rather than a finding of the cited reporting. In the authors’ view, confirmation is best reserved for high-impact, low-frequency actions such as external sends that include CRM data, with narrower defaults elsewhere. Because both disclosures depend on vendor status as of the cited coverage, readers should re-check Salesforce’s current remediation status before relying on this note.

The wider inherited-surface problem

Both published chains used the lead form, but this note assumes the issue is broader. Any feature that lets outside parties write text into records an agent later reads is a candidate channel. Candidates include case-creation paths from email or web forms, community or portal posts, chat transcripts, and imported contact data. The same chain plausibly extends from inbound email or web-to-case submissions through a case record to an agent prompt and back out through case comments or replies; this note treats that as an inference from the demonstrated pattern and has not verified it against vendor documentation or reproduced it. Related CSA work on Agent Data Injection shows that even structured metadata an agent trusts can be corrupted [8], which means the review should not be limited to free-text fields.

Recommendations

Immediate Actions

Organizations running Agentforce should identify every automation, topic, or agent that reads records created through public-facing features, and record which of those agents can send email, call external services, or render links. Where an agent that reads public-origin records can also communicate externally, restrict or disable the external action until the controls below are in place. Confirm that Trusted URL enforcement is active and review the allow-list for expired or unowned domains, as the ForcedLeak chain depended on one [5]. Enable the Einstein Trust Layer prompt injection detection setting where available, treating it as one layer among several [7].

Short-Term Mitigations

Scope each agent’s data access to the minimum its topic requires, so that a hijacked agent cannot query unrelated records in bulk. Apply recipient and volume limits to outbound email sent by agents, and require confirmation for external sends that contain CRM fields. Log the full text of records ingested into agent context together with each action taken, so that investigators can tie an outbound message to the intake submission that caused it. Test custom topics specifically, since Capsule’s retest results concerned Custom Topics rather than default configurations [4]. Add intake-originated records to the organization’s agent red-team scenarios, using synthetic payloads rather than live customer data.

Strategic Considerations

Treat agent enablement as a change that re-opens the threat model of every upstream system, and make that review a condition of go-live. Where possible, separate public-origin content from instructions at the platform level, for example by passing intake text as clearly marked data under a separate channel rather than concatenating it into the prompt. Consider quarantined-model patterns in which an agent that reads untrusted text cannot itself take privileged actions. Ask vendors for documentation of channel separation, destination controls, and the status of any reported issue, including whether a CVE or equivalent identifier has been assigned, since the absence of one for PipeLeak limits how defenders can track it [3][4].

CSA Resource Alignment

CSA’s research note on Agent Data Injection [8] describes an attack class that corrupts the factual metadata an agent trusts, instead of embedding instructions. It is relevant here because intake records contain both free text and structured fields, and the inherited-surface review recommended above should cover both. CSA’s Promptware and Agentic C2 note [9] covers how injected content can drive multi-stage attacker-directed behavior, which is the downstream risk if an intake payload instructs an agent to act repeatedly or persistently rather than once.

For control mapping, the AI Controls Matrix v1.1 [10] provides the Application and Interface Security, Identity and Access Management, and Logging and Monitoring domains that correspond to the data scoping, egress restriction, and ingest logging recommendations. MAESTRO [11] supports the threat-modeling exercise by layer, with the intake feature sitting in the Data Operations layer and the egress path in the Agent Ecosystem layer. CSA’s whitepaper Prompt Injection in Agentic AI Pipelines [12] supplies a defense framework structured around MAESTRO and informs the architectural principles used in this note.

References

[1] The Hacker News. “Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection.” The Hacker News, September 2025.

[2] CSO Online. “Vulnerability in Salesforce AI could be tricked into leaking CRM data.” CSO Online, September 2025.

[3] CSO Online. “Copilot and Agentforce fall to form-based prompt injection tricks.” CSO Online, April 2026.

[4] VentureBeat. “Microsoft patched a Copilot Studio prompt injection. The data exfiltrated anyway.” VentureBeat, April 2026.

[5] The Register. “Prompt injection – and a $5 domain – trick Salesforce Agentforce into leaking sales.” The Register, September 26, 2025.

[6] Varonis. “ForcedLeak and the Future of AI Agent Security.” Varonis Blog.

[7] PromptArmor. “One key way Salesforce mitigates AI risk.” PromptArmor.

[8] Cloud Security Alliance. “Agent Data Injection: A New Attack Class Beyond Prompt Injection.” CSA, 2026.

[9] Cloud Security Alliance. “Promptware and Agentic C2: The Confirmed Attack Class.” CSA Labs, May 2026.

[10] Cloud Security Alliance. “AI Controls Matrix v1.1.” CSA.

[11] Cloud Security Alliance. “Agentic AI Threat Modeling Framework: MAESTRO.” CSA Blog, February 6, 2025.

[12] Cloud Security Alliance. “Prompt Injection in Agentic AI Pipelines: Enterprise Attack Patterns and Defense Framework.” CSA Labs, May 7, 2026.

[13] Simon Willison. “The lethal trifecta for AI agents: private data, untrusted content, and external communication.” Simon Willison’s Weblog, June 16, 2025.