Three cases
In a July 2025 demonstration by the security firm General Analysis, a support ticket with hidden instructions led a developer's assistant that had database authority to copy tokens into the ticket thread; the permission behind it was a database role that could read the token table. In September 2025, Noma Labs researchers showed that instructions in a web-to-lead description field could make a Salesforce Agentforce agent leak CRM data; the permission behind it was CRM data the agent could read plus an outbound link the allowlist still permitted, and Salesforce has patched it. In August 2025, one prompt of about 400 characters gave stored cross-site scripting against Lenovo's support bot that could expose session cookies; the permission behind it was chat history rendered in an agent's browser.
The common thread is text from outside, treated as an instruction by something with access.
The pattern
The three ingredients are private data, untrusted text and a way to send data out. OWASP lists prompt injection (LLM01) and excessive agency (LLM06) as top risks, and recommends least privilege and human approval for sensitive actions. Less access limits the harm; it does not stop the bot being tricked.
- List everything the bot can read, write and send.
- Remove what the job does not need and make the rest read-only.
- Require a person to approve anything that sends, spends or deletes.
What a test can and cannot show
A set of hostile inputs run several times in a sandbox shows whether your limits held on those inputs on that day. It does not show the bot is secure, and tailored attacks can still work. The paid test names the permission to remove for each failure and retests after you change it.
Sources and limits
- General Analysis: Supabase MCP leak (8 Jul 2025) Checked 2026-10-12.
- In a July 2025 demonstration with dummy data, a support ticket containing hidden instructions led a developer's assistant with database authority to copy access tokens into the ticket thread.
- Simon Willison: the lethal trifecta (16 Jun 2025) Checked 2026-10-12.
- Private data, untrusted content and a way to send data out together make an agent exploitable.
- Noma Security: ForcedLeak, agent risks exposed in Salesforce Agentforce (25 Sep 2025) Checked 2026-10-12.
- Noma Labs researchers showed that instructions in a web-to-lead description field could make an Agentforce agent leak CRM data through an outbound link the allowlist still permitted; Salesforce released patches.
- Cybernews: Lenovo chatbot Lena (19 Aug 2025) Checked 2026-10-12.
- One prompt of about 400 characters gave stored cross-site scripting that could expose session cookies of customers and agents of Lenovo's support bot; it was fixed after disclosure.
- OWASP Top 10 for LLM Applications 2025 Checked 2026-10-12.
- LLM01 is prompt injection and LLM06 is excessive agency, and the listed mitigations include least privilege and human approval for sensitive actions.