security1 publisher
Planted web-form lead steered Salesforce Agentforce into leaking CRM records to an outside server
Noma Labs disclosed ForcedLeak, a CVSS 9.4 chain that let a planted Salesforce web-form lead steer Agentforce into leaking CRM data. Salesforce blocked the exit on September 8, leaving audits of recent leads and agent activity as the open task.
Publishers:noma.security
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+35
- Incentives75
- Confidence50