Disclosed vulnerability
Prompt Mines: 0-click CRM record corruption in Salesforce Einstein via Email-to-Case / Web-to-Case
AIR-2025-0097 AIR record · 2025-08-salesforce-prompt-mines-einstein
From the supporting source
As of today, the attack still workslabs.zenity.io
The record
Disclosed
2025-08-14
Vendor
Salesforce
Product
Salesforce Einstein
Risk domain
Access control and permissions › Confused deputy
System type
Generative model
Who acted
Agent acted — Einstein wrote corrupted records into the CRM
Attack surface
Enterprise assistant
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection crm record
Impact type
Data integrity loss, Business process manipulation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Validate delegation chains; Use signed attestations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Salesforce orgs with Einstein and public Email-to-Case or Web-to-Case intake
Capability abused
Defense & remediation
Recorded defense
Salesforce design that prevents the LLM from reading tool results directly
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
none at time of publication
Taxonomy & references
Curator notes
Zenity Labs, published 2025-08-14. 'Attackers can leverage Prompt Mines to hijack Einstein into corrupting CRM records'; malicious instructions planted in CRM records lie dormant until a user's follow-up question activates them, after which 'Einstein will corrupt all customer contact information behind the scenes'. Salesforce said its engineering team was already aware but gave no fix timeline. Related Zenity AgentFlayer finding: attackers rerouting all case email addresses through an attacker-controlled server.
Supporting sources
Cite as
Enkrypt AI. "Prompt Mines: 0-click CRM record corruption in Salesforce Einstein via Email-to-Case / Web-to-Case". AIR, AIR-2025-0097. https://agentincident.vercel.app/i/AIR-2025-0097/ (accessed 2026-10-19).