SECURITY researchers at Zenity Labs disclosed “SalesBleed”, an attack chain involving zero-click vulnerabilities in Salesforce Agentforce. Attackers could hide prompt-injection instructions in public Web-to-Lead forms, whose submissions are stored in CRM records. When an Agentforce agent later processed a poisoned record during normal operations, the instructions could redirect its behaviour.
The chain relied on the agent treating record content as instructions, its ability to render links or images in its interface, and access to sensitive tools and data.
According to Zenity, the compromised agent could query CRM information such as company names, deal sizes and other fields, then exfiltrate it through DNS-based techniques. This bypassed Salesforce Trusted URLs redaction controls, which are intended to prevent data leakage through outbound links. The attack required neither victim interaction nor attacker authentication or direct access to the Salesforce organisation: submitting the malicious lead was sufficient, with normal agent processing completing the chain.
Zenity reported the vulnerabilities to Salesforce in June, and Salesforce fixed the URL-redaction bypass on 18 August. The article does not report confirmed exploitation in the wild.
Zenity warned that the broader risk extends beyond Agentforce. AI agents may face a similar exposure when they process externally submitted, untrusted records, can display rich content, and have access to sensitive backend data. The researchers said the available data could include anything reachable through the agent’s Query Records tool, including accounts and contacts in a typical CRM deployment.