Zenity Discloses SalesBleed Flaws in Salesforce Agentforce
TL;DR
- The only entry point was a public Web-to-Lead form: no credentials, no tenant access, and no victim click were required at any point.
- Salesforce confirmed the Trusted URLs fix on Aug 18-19, replacing regex-based URL identification with standards-compliant RFC 3986 parsing.
- Two distinct exfiltration channels operated independently: DNS lookups triggered by HTML img tags, and Slack's automatic link-preview crawling.
Zenity Labs says it found three flaws in Salesforce Agentforce that let attackers steal CRM data with no clicks required, using nothing more than a poisoned Web-to-Lead form. SecurityWeek reports that the researchers, who branded the chain SalesBleed, disclosed the vulnerabilities to Salesforce on June 1, 2026, and Salesforce shipped fixes for all three by August 19.
The mechanic is what makes it striking. "Malicious instructions injected into a Web-to-Lead lead would remain dormant until an employee asks an Agentforce agent to interact with the submission," Zenity Labs wrote. Once the agent processed the poisoned lead, the hidden prompt ran inside a trusted context and exfiltrated data via HTML image tags, bypassing the Trusted URLs allowlist that is supposed to lock outbound calls to approved domains. According to the write-up, "Zenity Labs discovered that the mechanism did not recognize top-level domains and that character sequences could tamper with URL parsing."
A second path abused Slack's link previews: "Specially constructed links can cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear." A third turned the agent into a phishing beachhead inside internal Slack channels, delivering messages that read as coming from a trusted system operating inside the workplace rather than an unfamiliar outside sender.
One detail in the disclosure should worry SOC teams more than the bugs themselves: "Agentforce reported that the content had been blocked by the organization's security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server." No CVEs were assigned. It lands the same week as OpenAI's DNS-exfiltration disclosure, another entry in a growing pattern across our agents coverage where the tool-use surface, not the model, is where the incident lives.
What others are reporting
-
Zenity Labs Read →
First-party technical writeup. Confirms DNS exfiltration via HTML img tags and Slack URL unfurling; documents .fun TLD and bracket-character bypasses; patch confirmed Aug 18-19.
The attacker never actually touches the tenant itself directly.
-
Business Wire Read →
Official PR wire with named executive quote from Zenity co-founder Michael Bargury; no CVE numbers assigned; confirms June 1 disclosure and two-week Salesforce patch window.
Hard boundaries remain one of the strongest tools we have for containing AI agents, but they are still software.
-
Infosecurity Magazine Read →
Frames SalesBleed as a structural design flaw, not an isolated Salesforce bug: any agent combining untrusted input, broad data reads, and rich content rendering shares the same pattern.
The attack required no click or credential theft. The lead submission alone was enough to seed the payload, and normal agent operation did the rest.
-
Cyber Security News Read →
Technical focus on the remediation: Salesforce replaced regex-based URL identification with standards-compliant parsing to close the redaction gap; includes concrete patch detail.
The technique was considered zero-click because the employee only needed to ask the agent an ordinary question about leads.
-
GBHackers on Security Read →
Highlights the Slack integration as a distinct exfiltration vector and provides a seven-item defensive checklist for organizations currently running Agentforce.
The data leaves the environment as soon as DNS resolution occurs.
Originally reported by securityweek.com
Read the original article →Original headline: Zenity Discloses SalesBleed: Three Zero-Click Prompt-Injection Flaws Exfiltrated CRM Data From Salesforce Agentforce