$5 for your AI Agent's Trust Boundary

Five dollars

Five dollars. That is what it cost an attacker to exfiltrate customer relationship data from Salesforce Agentforce in September 2025. They bought an expired domain that Salesforce had left on its Content Security Policy allowlist, then redirected the AI agent’s output there via a crafted lead form. No phishing. No malware. No CVE to patch on your side. Just a USD 5 domain registration, an unreviewed allowlist, and an AI agent that trusted the destination it was pointing at.

Check your CSP allowlist before your next AI platform deployment. That is the one thing this post is about.

The $5 trust-boundary attack end to end: an attacker buys a USD 5 expired vendor domain that is still trusted on an unreviewed CSP allowlist, bends an enterprise AI agent such as M365 Copilot or Salesforce Agentforce through crafted input, and exfiltrates customer data across the egress boundary. countered by an immediate allowlist and OAuth audit now, and a longer-term scoped-identity model next

What happened, and to whom

Between June and November 2025, five named incidents defined a new attack class. Not attacks on your network. Not attacks on your endpoints. Attacks on your AI agents, and through them, everything those agents can reach.

The five: EchoLeak (CVE-2025-32711, CVSS 9.3, Microsoft 365 Copilot, Aim Labs, June 2025), ForcedLeak (CVSS 9.4, Salesforce Agentforce, Noma Labs, September 2025), CoPhish (Copilot Studio OAuth abuse, Datadog Security Labs, October 2025), Amazon Q Developer for VS Code (AWS-2025-015, 964,000 installs, July 2025), and Agent Session Smuggling (Palo Alto Unit 42, proof of concept, October 2025).

Five platforms. One attack surface they all share: the trust boundary the AI agent operates within, and how easily it can be bent.

What this costs

None of these required a compromised account or a zero-day in your firewall.

EchoLeak was zero-click. A crafted email triggered M365 Copilot to exfiltrate Outlook, OneDrive, SharePoint, and Teams data without the victim interacting with anything at all. The data moved through a Microsoft Teams domain that Copilot’s Content Security Policy trusted. No alert. No MFA challenge. The agent acted exactly as designed, on the wrong instruction, toward a trusted destination.

ForcedLeak used the same mechanism. The attacker’s USD 5 domain was already on the allowlist from a previous legitimate vendor. The agent routed customer data there without hesitation. Amazon Q almost deleted cloud resources across an organization because someone merged a pull request containing a destructive system prompt. A syntax error in the attacker’s payload was the only thing that prevented execution. That is not a control. That is luck.

How the attack works

How the attack works: a five-step flow showing an attacker turning a $5 expired domain on a CSP allowlist into customer-data exfiltration through an AI agent. the expired domain enabler, an injected instruction, the AI agent acting on it, the CSP allowlist failing open at the trust boundary, and data exfiltration

The pattern across the CSP-related incidents is worth understanding as one problem, not three separate ones.

AI agents inherit their operator’s permissions and act on instructions that can come from anywhere, including untrusted content the agent reads, retrieves, or processes. The Content Security Policy allowlist is supposed to be the egress boundary: it defines where the agent is permitted to send data. But allowlists are configured at deployment and rarely reviewed afterward. Vendor integrations expire. Contracts end. Domains lapse, and get purchased by someone else for USD 5.

EchoLeak exploited this via a Markdown image request routed through a trusted Microsoft Teams domain. ForcedLeak exploited it directly through an expired vendor domain still sitting on the allowlist. In both cases, the attacker did not breach the perimeter. They routed output toward a destination the platform already trusted.

CoPhish worked differently. not CSP, but the same underlying principle. A malicious agent hosted on the legitimate copilotstudio.microsoft.com domain forwarded OAuth tokens through token.botframework.com to an attacker-controlled endpoint. The platform’s own domain was the trusted path. Datadog disclosed it in October 2025. Microsoft acknowledged the issue.

Amazon Q was a supply chain attack on the developer toolchain itself. An external contributor submitted a pull request to the extension’s repository with a destructive system prompt buried in the code. It was merged because a CodeBuild GitHub token had inappropriately scoped write access. AWS issued a patch. The syntax error was what stopped the damage.

Agent Session Smuggling remains proof of concept. Unit 42 demonstrated it in October 2025 against Google’s Agent-to-Agent protocol: a malicious agent injecting into a peer agent’s session to trigger unauthorized actions, including, in the demonstration, unauthorized stock trades. Not in the wild yet. But the inter-agent trust problem it describes is being built into production architectures right now, without a resolved answer.

What to do before your next deployment

One action: pull your Content Security Policy allowlist on every AI surface in production and cross-reference it against active vendor contracts.

Look for domains belonging to vendors you no longer have an active relationship with, domains added during a pilot and never cleaned up, and domains registered or transferred recently that you do not recognise. If a domain appears on your allowlist and you cannot trace it to a current contract or active integration, remove it. ForcedLeak required USD 5 and an afternoon. Your allowlist review should not take longer than that.

Two follow-on actions while you have the configuration open. Audit OAuth scope strings on every agent platform, the actual strings, not the UI description. If an agent holds organization-wide read access for a task that only required folder-level access, that scope is your next exposure. And add two-reviewer approval for any repository containing AI agent configuration files, system prompts, or developer tool extensions. Amazon Q’s destructive payload was merged through a single-approver path.

The longer fix

Target systems need to stop treating the agent as a trusted operator.

The agent will follow instructions. That is what it is built to do. The question is whose instructions. OWASP Agentic Top 10 entry ASI02 is explicit: authorisation decisions must not be delegated to the LLM. Target systems need to enforce their own access controls and treat the agent as a non-human privileged identity with scoped, short-lived credentials per tool. Not a long-lived platform token. Not shared keys.

I have not found a clean answer for multi-agent architectures yet. When Agent A calls Agent B calls a tool, the trust chain compounds fast. Unit 42’s Agent Session Smuggling research points at a real problem the A2A protocol has not fully resolved. Worth watching closely.

Bottom line

Your CSP allowlist was configured at deployment. Your threat landscape changed every month since. Close the gap.

For the people in the room

When did your team last audit the Content Security Policy allowlist on your production AI platforms, and did that review include checking for expired vendor domains?

References

ForcedLeak. Noma Labs primary disclosure. noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce
EchoLeak. NVD CVE-2025-32711. nvd.nist.gov/vuln/detail/CVE-2025-32711
EchoLeak. Aim Labs disclosure. aim.security/lp/aim-labs-echoleak-m365
CoPhish. Datadog Security Labs. securitylabs.datadoghq.com/articles/cophish-using-microsoft-copilot-studio-as-a-wrapper
Amazon Q Developer for VS Code. The Register. theregister.com/2025/07/24/amazon_q_ai_prompt
Amazon Q. AWS Security Bulletin AWS-2025-015. aws.amazon.com/security/security-bulletins/AWS-2025-015
Agent Session Smuggling. Palo Alto Unit 42. unit42.paloaltonetworks.com/agent-session-smuggling
OWASP Top 10 for Agentic Applications 2026. genai.owasp.org