Zenity Discloses SalesBleed Flaws in Salesforce Agentforce
TL;DR
- Zenity's technical writeup identifies the bypass root: Salesforce's redactor failed on unrecognized TLDs like .fun and on URLs terminated with curly braces or square brackets.
- Two of the three flaws exfiltrate data via DNS lookups triggered when Agentforce renders an HTML image tag, bypassing HTTP egress controls without any outbound HTTP request from the victim.
- The attack enters through Salesforce's own public Web-to-Lead form, an unauthenticated input surface every Salesforce org exposes, with the payload staying dormant until any employee queries the poisoned lead.
Zenity Labs says it found three flaws in Salesforce Agentforce that let attackers steal CRM data with no clicks required, using nothing more than a poisoned Web-to-Lead form. SecurityWeek reports that the researchers, who branded the chain SalesBleed, disclosed the vulnerabilities to Salesforce on June 1, 2026, and Salesforce shipped fixes for all three by August 19.
The mechanic is what makes it striking. "Malicious instructions injected into a Web-to-Lead lead would remain dormant until an employee asks an Agentforce agent to interact with the submission," Zenity Labs wrote. Once the agent processed the poisoned lead, the hidden prompt ran inside a trusted context and exfiltrated data via HTML image tags, bypassing the Trusted URLs allowlist that is supposed to lock outbound calls to approved domains. According to the write-up, "Zenity Labs discovered that the mechanism did not recognize top-level domains and that character sequences could tamper with URL parsing."
A second path abused Slack's link previews: "Specially constructed links can cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear." A third turned the agent into a phishing beachhead inside internal Slack channels, delivering messages that read as coming from a trusted system operating inside the workplace rather than an unfamiliar outside sender.
One detail in the disclosure should worry SOC teams more than the bugs themselves: "Agentforce reported that the content had been blocked by the organization's security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server." No CVEs were assigned. It lands the same week as OpenAI's DNS-exfiltration disclosure, another entry in a growing pattern across our agents coverage where the tool-use surface, not the model, is where the incident lives.
What others are reporting
-
Zenity Labs Read →
First-party technical writeup from the discovering researchers; details the exact TLD and URL-termination-character bypasses of the redaction layer and the full DNS exfiltration chain.
The attacker never actually touches the tenant itself directly.
-
Business Wire (via Yahoo Finance) Read →
Official vendor press release with coordinated disclosure timeline and CTO Bargury's framing of hard agent boundaries as still-breakable software.
Hard boundaries remain one of the strongest tools we have for containing AI agents, but they are still software.
-
Infosecurity Magazine Read →
Frames SalesBleed as evidence of a systemic pattern: any agent processing untrusted external input while holding broad data access and rendering rich content faces the same architectural exposure.
-
CyberSecurityNews Read →
Details the remediation: Salesforce swapped regex-based URL identification for standards-compliant parsing, and clarifies the employee trigger was nothing more than asking Agentforce a routine question about leads.
The technique was considered zero-click because the employee only needed to ask the agent an ordinary question about leads.
-
CyberPress Read →
Adds Salesforce's own statement that no exploitation in the wild was detected, and notes remediation now requires user confirmation for Slack-based Agentforce actions.
A single contaminated lead could be triggered repeatedly whenever employees ask Agentforce to review it.
Originally reported by securityweek.com
Read the original article →Original headline: Zenity Discloses SalesBleed: Three Zero-Click Prompt-Injection Flaws Exfiltrated CRM Data From Salesforce Agentforce