{
 "public_id": "AIR-2025-0097",
 "incident_id": "2025-08-salesforce-prompt-mines-einstein",
 "date_disclosed": "2025-08-14",
 "date_occurred": null,
 "title": "Prompt Mines: 0-click CRM record corruption in Salesforce Einstein via Email-to-Case / Web-to-Case",
 "class": "responsible_disclosure",
 "attack_surface": "enterprise_assistant",
 "initial_vector": "indirect_prompt_injection_crm_record",
 "agent_capability_abused": [
  "crm_record_retrieval",
  "record_write",
  "tool_calling"
 ],
 "target_product": "Salesforce Einstein",
 "target_vendor": "Salesforce",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "data_integrity_loss",
  "business_process_manipulation"
 ],
 "blast_radius": "Salesforce orgs with Einstein and public Email-to-Case or Web-to-Case intake",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "zero_click",
   "indirect_prompt_injection",
   "delayed_trigger",
   "data_poisoning",
   "agent_hijack"
  ]
 },
 "defense_present": "Salesforce design that prevents the LLM from reading tool results directly",
 "defense_bypassed": true,
 "fix_shipped": "none at time of publication",
 "primary_sources": [
  "https://labs.zenity.io/post/prompt-mines-0-click-data-corruption-in-salesforce-einstein-1cfb"
 ],
 "verified_quote": "As of today, the attack still works",
 "confidence": "high",
 "notes": "Zenity Labs, published 2025-08-14. 'Attackers can leverage Prompt Mines to hijack Einstein into corrupting CRM records'; malicious instructions planted in CRM records lie dormant until a user's follow-up question activates them, after which 'Einstein will corrupt all customer contact information behind the scenes'. Salesforce said its engineering team was already aware but gave no fix timeline. Related Zenity AgentFlayer finding: attackers rerouting all case email addresses through an attacker-controlled server.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [],
 "risk_override_reason": "attacker-supplied case and lead text corrupted real CRM records with no user action",
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Einstein wrote corrupted records into the CRM",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_crm_record",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "salesforce_agentforce",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "confused_deputy",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [],
 "eai_reason": "impact rule: confused_deputy",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI03 (eai_category=confused_deputy)",
 "submitted_by": "EAI Internal"
}