Prompt injection scanner for Salesforce Einstein AI

Four attack surfaces specific to Salesforce Einstein AI

1. Einstein Copilot case image attachments (Service Cloud). Service Cloud cases allow customers to attach images — photos of defective products, screenshots of error messages, ID documents for verification. Einstein Copilot's Service Replies and Case Summary features include case attachments in the context window when generating suggested text. An adversarial image attached to a case (containing typographic injection text in a font that appears normal but encodes instructions) can redirect Copilot's suggested reply to contain incorrect resolution steps, inappropriate content, or instructions designed to trigger escalation to a more expensive support tier. Unlike a single-user chatbot session, a case attachment is persistent — it affects every Copilot interaction with that case until the attachment is removed.

2. Einstein Vision Apex callouts. Einstein Vision (available as a Predictive model in Salesforce Einstein Platform) is invoked from Apex using ConnectApi.EinsteinAI.predictImage() or the predictive vision REST API. Apex processes the returned classification JSON and uses it to update records, trigger Flow, or route cases. An adversarial image crafted to manipulate Einstein Vision's classification output (returning a false positive for a high-priority category, for example) causes downstream Apex logic to take incorrect actions. The model's classification output is treated as authoritative data by the calling Apex — if the classification JSON says "defect severity: critical", the Flow will escalate regardless of the actual image content.

3. Data Cloud multimodal document ingestion. Salesforce Data Cloud can ingest external documents — PDFs, images, and Office files — from connected data sources (AWS S3, Azure Blob, Google Cloud Storage, or directly uploaded to Data Cloud). These documents are chunked, embedded, and stored in Data Cloud's vector store. Einstein's Retrieval-Augmented Generation (RAG) layer retrieves relevant chunks and sends them to the LLM (typically GPT-4o via Einstein's model layer or a Bring Your Own LLM endpoint) when answering queries. A PDF ingested from an external source containing embedded adversarial images can cause the LLM to output injected instructions whenever a query retrieves that document chunk. Unlike a live case attachment, the injected document persists in the vector store until the ingestion pipeline re-processes and removes it.

4. Agentforce agent tool results with image data. Agentforce agents (Salesforce's agentic AI layer) can invoke MuleSoft Anypoint connector actions as tools. A connector that retrieves product images, report screenshots, or external document thumbnails from a third-party API returns image data as part of the tool result. The Agentforce agent's LLM then processes this tool result to plan subsequent actions. An adversarial image returned by a compromised or untrusted external API (a supplier portal, a competitor price-comparison service, a public web scrape) can inject instructions that redirect the agent's action plan before the agent executes the next step.

Integration: Apex HTTP callout scan gate

// Apex: scan an image attachment before processing with Einstein Copilot
// Call from a before-insert trigger on ContentDocumentLink (case attachment)

public class GlyphwardScanGate {

    private static final String SCAN_ENDPOINT = 'callout:GlyphwardAPI/v1/scan';
    private static final Integer INJECTION_THRESHOLD = 65;

    public static Boolean isSafeImage(Blob imageBlob, String source) {
        // Base64-encode the image
        String b64Image = EncodingUtil.base64Encode(imageBlob);

        // Build request body
        Map<String, Object> payload = new Map<String, Object>{
            'image' => b64Image,
            'source' => source
        };
        String requestBody = JSON.serialize(payload);

        // HTTP callout (Named Credential 'GlyphwardAPI' stores the API key)
        HttpRequest req = new HttpRequest();
        req.setEndpoint(SCAN_ENDPOINT);
        req.setMethod('POST');
        req.setHeader('Content-Type', 'application/json');
        req.setBody(requestBody);
        req.setTimeout(8000);

        HttpResponse res = new Http().send(req);

        if (res.getStatusCode() != 200) {
            // Fail-closed: scanner unreachable → reject
            System.debug('Glyphward scan failed: ' + res.getStatusCode());
            return false;
        }

        Map<String, Object> result =
            (Map<String, Object>) JSON.deserializeUntyped(res.getBody());
        Integer score = (Integer) result.get('score');

        if (score >= INJECTION_THRESHOLD) {
            System.debug(
                'Image rejected: score=' + score +
                ', scan_id=' + result.get('scan_id') +
                ', source=' + source
            );
            return false;
        }
        return true;
    }
}

// Trigger: block adversarial case attachments before Einstein Copilot sees them
trigger ScanCaseAttachment on ContentDocumentLink (before insert) {
    List<ContentDocumentLink> caseLinks = new List<ContentDocumentLink>();
    for (ContentDocumentLink link : Trigger.new) {
        if (link.LinkedEntityId.getSObjectType() == Case.sObjectType) {
            caseLinks.add(link);
        }
    }

    if (caseLinks.isEmpty()) return;

    Set<Id> docIds = new Set<Id>();
    for (ContentDocumentLink link : caseLinks) {
        docIds.add(link.ContentDocumentId);
    }

    Map<Id, ContentVersion> versions = new Map<Id, ContentVersion>(
        [SELECT Id, ContentDocumentId, VersionData, FileType
         FROM ContentVersion
         WHERE ContentDocumentId IN :docIds
         AND IsLatest = true
         AND FileType IN ('PNG', 'JPG', 'JPEG', 'GIF', 'WEBP')]
    );

    for (ContentDocumentLink link : caseLinks) {
        ContentVersion cv = versions.get(link.ContentDocumentId);
        if (cv == null) continue;

        Boolean safe = GlyphwardScanGate.isSafeImage(
            cv.VersionData,
            'case_attachment:' + link.LinkedEntityId
        );

        if (!safe) {
            link.addError(
                'This image failed the security scan. Please contact support if you believe this is an error.'
            );
        }
    }
}

Get early access

Coverage matrix

Related questions

Further reading

• Multimodal prompt injection in agentic RAG pipelines — multi-hop injection in retrieval-augmented systems.
• Prompt injection prevention best practices — full defence-in-depth stack.
• Multimodal AI security checklist — 40-point binary checklist for security reviews.
• Real-time vs batch prompt injection scanning — when to scan synchronously vs asynchronously.
• Multimodal LLM security API — Glyphward API overview.