Vulnerability / research

PipeLeak redirects Agentforce custom actions toward data exfiltration

Reported

What happened

A malicious lead description redirected an Agentforce agent into querying additional lead records and emailing them externally through custom Salesforce flows.

Parties and reporting

AI tools and systems: Salesforce Agentforce, Salesforce Flow

Outcome

Salesforce characterized the demonstrated exfiltration as configuration-specific; built-in email actions and configurable approval controls provide different protections.

Operating lesson

Require approval for sensitive custom actions and constrain both the records agents can query and external recipients.

Evidence and limits

Controlled custom-action deployment; no confirmed malicious exploitation. Salesforce disputes treating the demonstrated configuration as a platform-wide vulnerability.

Sources