Salesforce 'ForcedLeak': Indirect Prompt Injection via Agentforce Web-to-Lead Forms

In a customer-controlled renderer, carry authoritative CRM sensitivity and provenance to derived URL values and authorize the exact image/link sink before any network request. The published value-level method needs complete derivation and sink coverage; an arbitrary model paraphrase cannot be tracked by adding a label at one gateway. A conservative alternative denies all external images after a private-data read. This is not the published value-level method, and Trusted URLs alone checks destinations rather than data sensitivity. Stock Agentforce capability is not assumed.

Use the mandatory canonical, pinned safe-fetch boundary for any customer-controlled URL preview or image retrieval, with a reviewed destination policy and no direct renderer fetch bypass. The published fetcher controls URL/IP/redirect and returned-byte bindings; it does not verify ongoing domain ownership and does not make CRM data safe to send to an allowed domain. Keep ownership review as a separate operational control and apply data-sensitive sink authorization. The stock browser CSP path is not this service implementation.

Observe CRM data in the exact response, image URL and network-request population before rendering where that adapter is available. Correlate content classification with destination and encoded query values; unknown coverage remains unresolved. Detection produces a finding, and a separate sink gate owns blocking. Generic PII scanning can miss transformed values and cannot guarantee no leakage.

Screen the external Description field before context assembly and mark it as untrusted. Test this exact image-URL payload and encoded variants, fail closed when required screening is unavailable, and keep independent tool and renderer authorization. Natural-language screening can miss persuasive or transformed instructions and cannot guarantee that every injected instruction is removed.

Classify CRM export, mutation and customer-bearing external image/link requests in a signed authority envelope and identify the runtime gate responsible for each action. This policy evidence supplies risk and scope to execution or sink controls; writing the classification alone does not block an effect.

Separate the untrusted lead parser from the privileged planner with independent process, credential and network boundaries. A validating broker may pass only bounded, task-specific fields and opaque record IDs; typed strings can still contain attacker instructions, so every CRM action and renderer sink needs independent authorization. This is a customer/provider architecture requirement, not two prompts inside the same agent or a guarantee that a validated summary is harmless.