VentureBeat reported research by Capsule Security on two prompt-injection issues, which the researchers named ShareLeak (Microsoft Copilot Studio) and PipeLeak (Salesforce Agentforce). We rely on that report; the vendors' advisories were not reviewed, and Salesforce's position differs from the researchers'.
ShareLeak, as reported
- Tracked as CVE-2026-21520 with a CVSS score of 7.5.
- Reported to Microsoft on 24 November 2025, confirmed 5 December, patched 15 January 2026, and disclosed publicly 15 April 2026.
- A crafted comment in a public SharePoint form could make the agent retrieve customer data and email it out; the email used a legitimate action, so data-loss prevention did not trigger.
PipeLeak, as reported
- A payload in a public lead form could hijack an Agentforce agent without authentication.
- Salesforce reportedly said the scenario was remediated and that human approval for email actions is on by default; the researchers say the email channel remains exploitable in certain configurations.
Lessons
- Any form, email or document that feeds an agent is an input an attacker can write to.
- Limit what a public-facing agent can read, and what it can send out.
- Require approval for outbound messages containing customer data.
- Include prompt-injection cases in your test suite.
Patches do not remove the design problem. Constrain the agent's permissions so that being fooled does limited damage.