Is Salesforce’s AI safe from prompt injection? The Trust Layer is real, but a disclosed vulnerability showed that enterprise-grade governance has not solved indirect prompt injection.
Plain-English risk rating: 2 of 5
Scope note, added 3 September 2026. Agentforce is not included in Salesforce’s base editions. From Salesforce’s own pricing it is bought as an add-on at $125 or $150 per user per month, as an Agentforce 1 edition from $550 per user per month, or as a $5 user licence with consumption-priced Flex Credits ($500 per 100,000 credits, or $2 per conversation). A single rating across all tiers therefore describes something a Salesforce customer does not have until they buy it separately. We are splitting this rating. Until we do, read the 2 of 5 as describing Agentforce as governed by the Einstein Trust Layer — not as a property of holding a Salesforce subscription.
Salesforce's AI products (Einstein for predictive features, Agentforce for agentic workflows) sit within Salesforce's enterprise-grade governance framework anchored by the Einstein Trust Layer. The Trust Layer is Salesforce's built-in mechanism for preventing agent prompts from being used to train external models, masking sensitive PII before it reaches an LLM, and logging all agent activity for audit purposes. As of late 2025, Salesforce's board formalised cybersecurity and AI deployment oversight in a dedicated Cybersecurity & Privacy Committee.
The risk picture for SMBs is dominated by three factors: (a) the September 2025 ForcedLeak disclosure (CVSS 9.4) which demonstrated that Agentforce's architecture is vulnerable to indirect prompt injection in ways the Einstein Trust Layer did not initially defend against, (b) the broader Salesforce ecosystem breaches affecting customer sites (ShinyHunters campaigns during 2025-2026, the Aura data breach affecting 900,000 records in March 2026), and (c) the high cost of entry that makes Salesforce impractical for most very small businesses.
Recommended for
- Sole proprietor: Not appropriate. Salesforce's pricing and complexity are designed for 10+ user organisations.
- Small team (10-50 people): Sales Cloud Pro Suite or Enterprise, with the Agentforce add-on if you want agents. Einstein Trust Layer should be configured during deployment. If using Agentforce with Web-to-Lead forms, apply Salesforce's September 8, 2025 Trusted URLs Enforcement (post-ForcedLeak patch) and audit lead data for suspicious submissions.
- Regulated industry: Salesforce Health Cloud or Financial Services Cloud with appropriate compliance configuration; Government Cloud for US federal contractors.
- The honest answer for most 1-10 employee businesses: Salesforce is enterprise software with enterprise pricing and enterprise complexity. HubSpot or Pipedrive are typically better fits at this scale. Profile here for completeness and for the SMB segment that has scaled into Salesforce territory.
Critical pre-deployment warning (Agentforce indirect prompt injection)
This is the most important security configuration item for any business running Agentforce with Web-to-Lead enabled: apply Salesforce's Trusted URLs Enforcement (deployed September 8, 2025) and audit existing lead data for suspicious submissions.
The September 2025 ForcedLeak disclosure (CVSS 9.4, Noma Labs research) demonstrated that an attacker could submit a malicious Web-to-Lead form containing prompt-injection instructions in the 42,000-character Description field. When an employee later asked Agentforce to summarise the lead, the injected instructions executed, causing Agentforce to exfiltrate CRM data via image tags pointing to attacker-controlled domains. The vulnerability was made worse by Salesforce's Content Security Policy whitelist including an expired domain that researchers purchased for $5 to demonstrate the attack.
Salesforce patched by enforcing Trusted URL allowlists; existing Agentforce deployments need to verify the enforcement is active.
Data retention default
- Standard Salesforce retention per workspace configuration
- Einstein Trust Layer enforces zero-retention with third-party LLM providers
- All agent activity logged for audit purposes
- Data Cloud retention configurable per use case
Training opt-out
NO TRAINING BY THE THIRD-PARTY MODELS. SALESFORCE'S OWN ACCESS TO YOUR DATA, INCLUDING TO TRAIN GLOBAL PREDICTIVE AI MODELS, IS ON BY DEFAULT.
Corrected 20 September 2026. This section previously read "NO TRAINING ON CUSTOMER DATA BY DEFAULT", which is broader than the evidence beneath it. See Corrections.
The Einstein Trust Layer prevents agent prompts from being used to train external models. Verified 3 September 2026 against Salesforce own trusted-AI page, which states it more specifically than we had: "Zero data retention is a strict policy where the prompts and generated responses are never stored or used to train the underlying third-party large language models". Note the scope of that sentence: it is about the third-party large language models. Salesforce also describes dynamic grounding, which retrieves validated customer-approved data at query time rather than training on it. The branding has moved to the Salesforce Trust Layer, and the AI product line to Agentforce rather than Einstein.
What stops this being a no-training position: Salesforce's Spring '26 release notes say: “Access to Customer Data is on by default unless you’re using Government Cloud or your organization has already decided not to share Customer Data with Salesforce.” Allowing access lets Salesforce use Customer Data in your org to “Train global predictive AI models for use by the services and features to which you have access”, to improve services and features, and for research and development. Since 4 February 2026 admins can switch it off in Setup (Einstein Setup → Opt Out of Customer Data Access) on Enterprise, Performance, Unlimited and Developer Editions; before that it took a support case. After opting out, “No new data is shared” and data already collected is deleted within 30 days. If you hold client data in Salesforce, check that setting. Corrected 3 October 2026: this section previously said Salesforce's own data-sharing programme was opt-in and off by default.
Zero Data Retention availability
- Default via Einstein Trust Layer for third-party LLM processing
- PII masking applied before content reaches LLM providers
Plan tiers and pricing (read 3 September 2026)
| Tier | Price (USD) | AI features | Suitable for |
|---|---|---|---|
| Starter Suite | $25/user/month | Limited AI | Small teams starting on Salesforce |
| Pro Suite | $100/user/month | More AI features | Growing sales teams |
| Enterprise | $175/user/month | Agentforce sold as an add-on | Mid-size teams |
| Unlimited | $350/user/month | Agentforce sold as an add-on | Larger orgs |
| Agentforce 1 Sales | $550/user/month | Agentforce built in | Organisations deploying agents at scale |
Table replaced 25 October 2026 with the editions and prices we read on Salesforce's own Sales Cloud pricing page on 3 September 2026 (most billed annually; Salesforce's page could not be read again on 24 October). The earlier table showed Professional $80, Enterprise $165 and Unlimited $330, and a $50 Einstein 1 Studio add-on Salesforce no longer presents that way. Salesforce has moved its AI branding from Einstein to Agentforce, built into the top edition and sold as an add-on for Enterprise and Unlimited. This profile is filed under Einstein; the underlying safeguard is now presented as the Salesforce Trust Layer.
Jurisdiction
- Primary processor: Salesforce Inc., San Francisco, California, USA
- Cloud infrastructure: Salesforce-operated (Hyperforce) with regional residency options
- Third-party AI: Salesforce's Agentforce Privacy FAQ (June 2025) gives “Anthropic which is hosted on AWS and OpenAI which is hosted on Microsoft Azure” as examples of the models used, and says OpenAI is a sub-processor where data is sent to it directly. Salesforce's Infrastructure and Sub-processors document (19 December 2025) lists OpenAI, Microsoft Azure, Google and AWS as generative AI providers for Einstein Generative AI. The Trusted AI page names no providers; it says prompts and generated responses “are never stored or used to train the underlying third-party large language models”, and that sensitive data is replaced with tokens before reaching the model (all read 24 and 25 October 2026). Corrected 25 October 2026, twice: we first removed Anthropic and OpenAI from this line for want of a Salesforce source, but Salesforce's own FAQ names both, and its sub-processor document adds Microsoft Azure and Google. See Corrections.
- SOC 2 Type II, ISO 27001, HIPAA (with BAA), FedRAMP Moderate (Government Cloud)
- Multi-region data residency available
Breach history (public incidents)
July-September 2025 — ForcedLeak (Noma Labs, CVSS 9.4)
The canonical Salesforce-AI security incident. Noma Labs disclosed ForcedLeak on September 25, 2025 after responsibly reporting it to Salesforce on July 28, 2025. Salesforce deployed Trusted URLs Enforcement on September 8, 2025 before public disclosure. CVSS severity 9.4 — comparable to the 9.3 EchoLeak in Microsoft 365 Copilot and the 9.6 CamoLeak in GitHub Copilot.
How it worked: An attacker submitted a Web-to-Lead form with prompt-injection instructions embedded in the 42,000-character Description field. When a Salesforce user later asked Agentforce to summarise the lead, the malicious instructions executed as if they were trusted prompts. Agentforce composed output containing an image tag referencing a Salesforce-CSP-allowlisted domain (which Noma researchers had acquired for $5 because it had expired and become available for purchase). The image request encoded exfiltrated CRM data in URL query parameters; the attacker's server logged the data while the AI agent saw only a normal image request.
For SMBs: this is the structural pattern that affects every agentic AI product. AI agents reading user-submitted content cannot reliably distinguish between data they should summarise and instructions they should execute. The patch closed the specific exfiltration vector but not the underlying class of vulnerability.
Sources: Noma Security blog (September 25, 2025); The Hacker News (September 26, 2025); The Register; Dark Reading; Dataconomy; SecurityAffairs; Nudge Security; Varonis; Infosecurity Magazine (March 2026 follow-up)
Ongoing 2025-2026 — ShinyHunters campaign against Salesforce Experience Cloud
The cybercriminal group ShinyHunters has conducted ongoing campaigns targeting Salesforce Experience Cloud sites during 2025-2026. The Aura data breach (March 2026, 900,000 records exposed) was one of the most-publicised incidents. The breaches are typically not Salesforce-platform compromises but rather customer-misconfiguration exposures.
Sources: Help Net Security (March 2026); TechRadar; SecurityWeek
Category-level risk: Agentforce's autonomous-agent capability puts it in the same prompt-injection risk class as Microsoft 365 Copilot (EchoLeak), GitHub Copilot (CamoLeak), and Cursor (NomShub). All four major agentic-AI products had CVSS 8+ disclosures during 2025. The structural lesson: defensive prompting and trust boundaries in agentic AI remain unsolved at the architectural level.
Agent features: what it can reach, keep, pass on and do
Checked 23 September 2026. This section describes agent features only and does not change the rating above: agents are not yet part of our scoring method. Everything here comes from Salesforce’s own published pages, linked at the end of the section. Where Salesforce does not say something, we say so rather than guess.
A limit, stated first. Salesforce’s developer and help documentation returned an error or loaded no readable text for our fetcher, so this section rests on one Salesforce page. We will extend it when we can read the technical documents, and we do not treat a missing statement as evidence either way.
What it can reach. Salesforce says its Trust Layer retrieves business data to ground Agentforce prompts “while maintaining permissions and data access controls”.
What it keeps, and where your content goes. Salesforce describes zero data retention with the third-party language models, under which prompts and generated responses are never stored or used to train those models, and masking of personal and confidential data with tokens before a prompt is sent. These statements cover what the outside model keeps. The page does not say how long Salesforce itself keeps agent conversations or action logs.
What it can do without asking. The page describes toxicity detection and security guardrails, but it does not say which Agentforce actions need a person to approve them. The prompt injection weakness described in the pre-deployment warning above is the reason that question matters here.
What to do.
- Ask your Salesforce partner or account team which Agentforce actions run without a human approval step in your org.
- Ask where agent conversations and action logs are kept, and for how long.
Source for this section, read 23 September 2026: Salesforce: Trusted AI.
What this means in plain English for SMB owners
Three honest takeaways:
- Salesforce is enterprise software with enterprise-grade governance — but ForcedLeak demonstrated that enterprise-grade governance has not solved indirect prompt injection. The Trust Layer is real and meaningful for most workloads. It did not prevent the September 2025 disclosure. Apply Salesforce's patches promptly; audit existing data for injection payloads.
- Most 1-10 employee businesses are not the right fit for Salesforce. The pricing alone rules it out. HubSpot is the typical privacy-comparable, SMB-appropriate alternative.
- The Salesforce ecosystem breach pattern matters indirectly. ShinyHunters has demonstrated that customer-side misconfigurations are exploited at scale. The Einstein Trust Layer is a strong product; the admin configuration discipline (including post-ForcedLeak Trusted URLs Enforcement) is what determines whether your tenant joins next year's breach statistics.
Sources
- Salesforce 2026 Proxy Statement (SEC DEF 14A): Cybersecurity & Privacy Committee charter (verified 2026-05-24)
- Noma Security: ForcedLeak Agent Risks Exposed in Salesforce Agentforce (September 25, 2025)
- The Hacker News: Salesforce Patches Critical ForcedLeak Bug (September 26, 2025)
- The Register: Prompt injection and a $5 domain trick Salesforce Agentforce (September 26, 2025)
- Dark Reading: Salesforce AI Agents Forced to Leak Sensitive Data (September 25, 2025)
- Dataconomy; SecurityAffairs; Nudge Security; Varonis; Infosecurity Magazine
- MindStudio: Salesforce Agentforce Architecture (April 2026)
- Help Net Security: ShinyHunters Salesforce Aura data breach (March 2026)
- Salesforce official statement to Infosecurity and The Register on ForcedLeak patches
- Salesforce Sales Cloud pricing (read 3 September 2026)
- Salesforce: Trusted AI, https://www.salesforce.com/artificial-intelligence/trusted-ai/ (read 3 September and 24 October 2026)
- Salesforce: Agentforce Privacy FAQ (June 2025), salesforce.com legal documents (read 25 October 2026)
- Salesforce: Infrastructure and Sub-processors (published 19 December 2025), salesforce.com legal documents (read 25 October 2026)
Related on AI Leakage
- Compare all 29 AI tools in the risk directory — see how Salesforce Einstein / Agentforce stacks up against the rest, tier by tier.
- Take the 5-minute “Am I Leaking?” check — a personalised view of your business’s AI exposure.
- Check a prompt before you paste it — our free Data-Safe Prompt Rewriter.
- Shadow AI vs AI leakage — why even approved tools like Salesforce Einstein / Agentforce can leak data.
- Get plain-English AI Leakage Alerts — we email you when an AI tool you use changes its data policy or has an incident.
- Get the free AI Acceptable Use Policy template — a plain-English policy with the tool-by-tool risk guide built in.
Compare similar tools: Salesforce Einstein / Agentforce is one of 4 tools in AI in customer service and CRM compared, which sets out each one’s rating and what it does with your data, side by side.