The Same Prompt Injection Trick Broke Both Salesforce Agentforce and Microsoft Copilot

Capsule Security researchers found the same attack pattern working against two of the biggest enterprise agent platforms on the market: Salesforce Agentforce and Microsoft Copilot. Both fell to form-based prompt injection, where malicious instructions sit hidden inside a public-facing form and get executed the moment an internal user asks the agent to process that form's contents.

Against Agentforce, the researchers dubbed the technique PipeLeak: instructions planted inside a public CRM form get treated as a legitimate task once an employee asks the agent to summarize or act on the submission. Against Copilot, the same idea worked through SharePoint forms, tracked as ShareLeak and assigned CVE-2026-21520. In both cases, the agent has no way to distinguish a form field written by an attacker from an instruction written by the person who asked it to do the work.

The Copilot vulnerability was confirmed on December 5, 2025 and Microsoft shipped a patch on January 15, 2026. According to CSO Online and VentureBeat's reporting, the underlying pattern kept working even after that patch landed, meaning the fix addressed a specific exploitation path rather than the structural problem of an agent trusting form input as if it were operator input.

The takeaway for any team running an agent connected to a public-facing form, whether it's a CRM lead form or a SharePoint intake form, is that the boundary between data a form collects and instructions an agent follows is not enforced by default on either of these platforms. Anything a form can accept, an attacker can use to write instructions your agent will treat as legitimate.