Noma Labs researchers disclosed a critical flaw, ForcedLeak (CVSS 9.4), in Salesforce Agentforce, reported by Security Affairs on 27 September 2025. An attacker could hide instructions in a Web-to-Lead form submission; when staff later asked the AI agent about that lead, it followed the hidden instructions and could exfiltrate sensitive CRM data, helped by an expired domain left on Salesforce's Content Security Policy allowlist. Only organizations using Agentforce with Web-to-Lead enabled were affected. Salesforce has since patched the issue and enforced Trusted URLs for Agentforce and Einstein AI (8 September 2025). No exploitation is reported.