AGENTFORCE-PT-01: Template Context Poisoning
🟡 Medium · Prompt Injection
A GenAI Prompt Template merges a record that outsiders can write (Lead via Web-to-Lead, Case via Web-to-Case / Email-to-Case, messaging transcripts, emails, or an object a guest site profile can create) straight into the prompt ({!$Input:Lead}, {!$Input:Lead.Description}, {!$RecordSnapshot:Case}). Text an attacker typed into a web form then reaches the model as instructions (indirect prompt injection). Primitive inputs (a question string the caller passes in) and Id-only references are not flagged: they carry the caller's own request across no privilege boundary. Severity policy: medium; high when the same template also asks for HTML, markdown, links or images, which a chat or Slack surface renders and can use to leak data.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-PT-01 |
| Severity | Medium |
| Category | Prompt Injection |
| Compliance | EU_AI_ACT_HIGH_RISK, NIST_AI_RMF |
Remediation
Isolate merge fields from system instructions using structural delimiters. Validate field content.