SalesBleed: 3 Flaws Hijack Salesforce AI Agents [2026]

Summary

Zenity Labs disclosed 'SalesBleed,' a set of zero-click vulnerabilities in Salesforce Agentforce that let attackers silently exfiltrate CRM data without any victim interaction and without ever authenticating into the target's Salesforce environment. Attackers plant hidden prompt-injection payloads in public-facing Web-to-Lead forms; when an Agentforce agent later processes that record during normal business operations, the embedded instructions hijack the agent's behavior.^[0]

Once triggered, the injected payload could instruct the agent to query and exfiltrate sensitive account data such as company names and deal sizes using DNS-based exfiltration techniques that evaded Salesforce's Trusted URLs redaction controls. The compromise required no click, no credential theft, and no direct access to the target organization — the lead submission alone seeded the payload and normal agent operation did the rest.^[0]

The weakness reflects the broader 'lethal trifecta' risk pattern for AI agents: combining access to private data, exposure to untrusted content, and the ability to communicate externally enables an attacker to trick an agent into leaking data. Zenity reported the issues to Salesforce in June and Salesforce fully fixed the URL redaction bypass on August 18. This is responsibly disclosed, patched vulnerability research with no evidence of in-the-wild exploitation or a named threat actor.^[0][18]

Attack chain

1. Initial injection via Web-to-Lead: An attacker submits a public Salesforce Web-to-Lead form containing hidden prompt-injection instructions. The data flows directly into CRM records and lies dormant until an Agentforce agent processes the record as part of normal business operations.^[0]
2. Indirect prompt injection / agent hijack: When the Agentforce agent processes the poisoned record, it trusts the record content as instructions, hijacking the agent's behavior. Because the agent holds access to sensitive tool and data permissions, the injected instructions can reach whatever the subagent's Query Records tool can access.^[0]
3. Zero-click exfiltration via Trusted URLs bypass: The hijacked agent queries sensitive CRM fields (company names, deal sizes and others) and exfiltrates them using DNS-based exfiltration that evaded Salesforce's Trusted URLs redaction controls. No click or credential theft was required.^[0]

Disclosure timeline

How it works

The attack relies on three ingredients present together: Agentforce ingests untrusted external input via Web-to-Lead forms; the agent trusts record content as instructions and is allowed to render links or images back to a user interface; and the agent holds access to sensitive backend tools and data. This is an instance of the 'lethal trifecta' — private data access, untrusted content exposure, and external communication capability — which lets an attacker trick the agent into retrieving and exfiltrating data.^[0][18]

Salesforce's Trusted URLs is a redaction control designed to prevent data leakage through outbound links to unapproved destinations. Zenity found that DNS-based exfiltration techniques evaded this control, allowing the hijacked agent to smuggle queried CRM data out even though Trusted URLs was intended to block exactly this kind of leakage.^[0]

The injected instructions in Zenity's demonstration requested company names and deal sizes, but the report notes the injection could request anything the subagent's Query Records tool can reach, which in a typical General CRM deployment includes accounts, contacts and more.^[0]

Affected versions and patch status

Key takeaways

• A public web form submission can be chained through indirect prompt injection into zero-click enterprise data theft when an AI agent trusts record content and holds broad tool access — no attacker authentication or user click is required.^[0]
• Containment controls such as Salesforce's Trusted URLs redaction can be bypassed (here via DNS-based exfiltration), so guardrails must be assumed fallible for any agent exhibiting the lethal trifecta of private data access, untrusted content exposure, and external communication.^[0][18]
• The vulnerabilities were responsibly disclosed and patched by Salesforce, with no evidence of in-the-wild exploitation or a named threat actor.^[0]

Defensive actions

• Treat untrusted external intake channels such as Web-to-Lead form submissions as potential prompt-injection vectors before an Agentforce agent processes them.: A single untrusted lead containing hidden instructions was enough to seed a payload that hijacked the agent and exfiltrated CRM data once the agent processed the record during normal operation.^[0]
• Reassess any AI agent that reads untrusted external records, renders rich content back to users, and holds access to sensitive backend data, since that combination recreates the same exfiltration pathway even outside Agentforce.: Zenity emphasized the underlying risk pattern is not unique to Agentforce; the same three ingredients sitting together create a latent path for prompt-injection-driven exfiltration.^[0][18]

Changelog

• Remediation timeline revised: the current reporting states Salesforce fully fixed the URL redaction bypass on August 18, superseding the earlier characterization that the Trusted URLs bypasses were remediated within approximately two weeks of a June 1 disclosure.^[0]
• Exfiltration technique re-characterized as DNS-based exfiltration that evaded the Trusted URLs redaction control, rather than image-request and Slack URL-unfurling channels described previously; the current evidence does not substantiate the Slack-based phishing/impersonation third flaw.^[0]