ForcedLeak — Salesforce Agentforce indirect prompt injection exfiltrates CRM data
Date: 2025-09
Affected: Salesforce Agentforce — enterprise CRM data
Attack vector: indirect-prompt-injection
Category: research-demonstrated
Severity: Critical
CVE: CVE-2025-10875
CVE-2025-64318
CVE-2025-64320
CVE-2025-64321
CWE: CWE-94
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Critical indirect prompt injection in Salesforce Agentforce allows external attacker to mislead the agent and exfiltrate sensitive CRM records outside the organization.

Impact: Sensitive customer data theft; compliance violation; enterprise trust damage

Mitigations:
Data access controls with least-privilege for agent queries
Input sanitization for CRM content processed by agents
Output monitoring for data exfiltration patterns

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: Agent follows injected instructions from external content
role: origin
label: Data Operations
notes: Sensitive CRM data exfiltrated to attacker
role: impact