Disclosed weakness · no CVE recorded

PipeLeak: Agentforce custom-action prompt injection

Salesforce · Agentforce custom lead and email flows

First documented disclosure · Review checkpoint

Summary

Capsule showed an untrusted lead submission redirecting an agent toward CRM data disclosure in a custom configuration.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Lead text becomes instructions that drive data-query and email actions.

Conditions required

A public lead form, an employee’s agent review, and custom actions permitting data access and external email without approval.

Potential impact

Disclosure of CRM records through the configured email tool.

Affected versions and configurations

The researcher’s custom Agentforce deployment; no platform-wide version range established.

Fix and mitigation status

No universal patched release established. Salesforce said default email actions require human approval and custom actions can enable it.

Practical next steps

Require approval for sensitive custom actions; restrict recipients and data access.

Operating lesson

Validate each agent action’s authority independently of the text it processes.

Evidence and limits

Salesforce characterized custom-action exfiltration as configuration-specific while investigating prompt injection. The disagreement is preserved; this is not a confirmed compromise of Salesforce customers.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources