“has the same three ingredients sitting in the same place,” the Zenity report noted.
How SalesBleed worked
Security researchers at Zenity Labs disclosed a set of zero-click vulnerabilities in Salesforce Agentforce that together formed an attack chain the team labelled “SalesBleed.” The exploit allowed attackers to silently exfiltrate CRM data without interaction from a victim and without the attacker ever authenticating into the target’s Salesforce environment.
Zenity’s report describes a compact three-part chain: prompt injection via public Web-to-Lead forms, an agent that trusts record content as instructions (including rendering links or images back to a user interface), and the agent’s underlying access to sensitive tool and data permissions. Attackers could plant hidden prompt-injection payloads inside public-facing Web-to-Lead forms; when an Agentforce agent later processed the seeded record during routine work, the embedded instructions hijacked the agent’s behavior.
Technical vector: Web-to-Lead, rendering, and DNS exfiltration
The injected payload could instruct the agent to query and quietly exfiltrate sensitive account data such as company names, deal sizes and other CRM fields. Zenity says the chain used DNS-based exfiltration techniques that evaded Salesforce’s Trusted URLs redaction controls — a safeguard intended to block data leakage through outbound links — allowing data to flow out undetected.
Critically, the submission of the lead alone was sufficient to seed the payload. The attack required no click from an end user, no credential theft, and no direct access to the target organization; normal agent operation completed the compromise.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTimeline: report, disclosure, and remediation
Zenity reported the vulnerabilities to Salesforce in June. Salesforce fully fixed the URL redaction bypass — which Zenity identified as the mechanism allowing the DNS-based exfiltration to succeed — on August 18, and Zenity published its findings on September 24. According to the report, fixing the Trusted URLs redaction bypass remediated the issues documented in SalesBleed.
What this means for technologists and security teams; affected enterprises and procurement leaders; adversaries and threat actors
- Technologists and security teams: The Zenity disclosure highlights three concrete trigger points to inspect: sources that ingest untrusted external input (Web-to-Lead), agent behaviors that render record content back into interfaces, and subagents or tools with authority to query backend records (for example, the Query Records tool). The researchers note that their payload asked for company names and deal sizes but “the injection could have asked for anything the subagent's Query Records tool can reach.”
- Affected enterprises and procurement leaders: Organizations using CRM agents that process externally submitted records should verify that the specific URL redaction bypass fixed on August 18 has been applied in their environments and review which agent components are permitted to render links or images from untrusted records. Zenity’s examples point to typical General CRM deployments where Query Records can reach accounts, contacts, and more.
- Adversaries and threat actors: The attack demonstrates an efficient, low-friction path: seed a public form once and let normal agent workflows exfiltrate data, all without accessing credentials or requiring a victim click. That zero-click, unauthenticated profile makes seeding public-facing forms an attractive vector where the three enabling elements are present.
A narrow fix, and a broader pattern
While Zenity’s disclosure shows a specific vulnerability chain in Salesforce Agentforce that has been patched, the report explicitly frames the concern as structural rather than accidental. “The underlying risk pattern is not unique to Agentforce,” the researchers wrote: any AI agent that reads or processes records submitted by external, untrusted sources, renders links, images, or other rich content back to users, and holds tool access to sensitive backend data “has the same three ingredients sitting in the same place,” creating a latent path for prompt-injection-driven exfiltration.
Zenity’s concrete demonstration — a payload that harvested company names and deal sizes via DNS exfiltration — serves as a proof-of-concept of that pattern. The specific sales-channel vector (Web-to-Lead) and the fix to Trusted URLs redaction controls addressed this instance, but the researchers’ framing makes clear the defense task reaches beyond a single product patch.
For those tracking enterprise AI risks, SalesBleed is a reminder that externally sourced records, rendering behavior, and tool privileges are a trio that can be exploited together; the work Zenity published documents one chain, one fix, and a pattern that will need attention wherever the three elements coexist.
