The attack is already in your index

In 2025, researchers embedded instructions in an ordinary web form and watched a Salesforce Agentforce agent retrieve sensitive CRM records and send them to an external address. Nothing about the model was compromised; the payload arrived the way every other piece of context arrives. This panel covers what teams are actually putting in place: provenance tracking that traces an action back to the document that triggered it, validation of external inputs before an agent acts on them, and detection that works on content nobody wrote by hand. Expect disagreement on whether poisoned context can be reliably cleaned, or whether untrusted content must simply stay away from anything privileged.