ForcedLeak. The access path.
A five dollar expired domain on Salesforce's allowlist carried CRM data out of Agentforce. No credential was stolen and no exploit was used. The agent's own CRM access did the work.
The record
Entry point. public Web-to-Lead form, payload placed in the Description field, which allows 42,000 characters.
The identity in the middle. The Agentforce agent's own standing CRM query access, invoked by a legitimate employee prompt. The second identity in the path is a domain: my-salesforce-cms.com, a lapsed Salesforce domain still trusted by the CSP allowlist.
What was reached. expired allowlisted domain, data embedded in an image request to a domain bought for five dollars.
A five dollar expired domain on Salesforce's allowlist carried CRM data out of Agentforce.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| public Web-to-Lead form | Entry | payload placed in the Description field, which allows 42,000 characters |
| CRM record | Step | the instructions sit in the database until an employee asks about the lead |
| Agentforce agent | Step | processes the legitimate question and the injected instructions together |
| agent CRM access | Step | queries lead and contact records including email addresses |
| expired allowlisted domain | Reached | data embedded in an image request to a domain bought for five dollars |
Where a breakpoint would have been
The allowlist. An expired domain that nobody removed is a standing grant with no owner, and it is the only step here an attacker could buy for five dollars. Salesforce shipped Trusted URLs Enforcement; the general lesson is that an agent's allowed output destinations age exactly the way credentials do.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the ForcedLeak incident?
The published path starts at public Web-to-Lead form, payload placed in the Description field, which allows 42,000 characters.
What did it reach?
The last step in the published path is expired allowlisted domain, data embedded in an image request to a domain bought for five dollars.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.