Salesforce Agentforce Vulnerabilities Discovered in SalesBleed Attack Chain

Researchers at Zenity Labs have disclosed a series of zero-click vulnerabilities in Salesforce Agentforce, dubbed ‘SalesBleed’, which allow attackers to silently exfiltrate sensitive customer relationship management (CRM) data.

The attack chain enables unauthorised parties to bypass authentication and extract sensitive information—including company names and deal sizes—without any interaction from a victim or direct access to the target’s Salesforce environment.

The SalesBleed Attack Chain

The vulnerability is triggered through prompt injection. Attackers plant hidden payloads within public-facing Web-to-Lead forms, a standard Salesforce feature used to allow external users to submit data directly into CRM records. When an Agentforce agent processes the submitted record as part of its normal business operations, the embedded instructions hijack the agent’s behaviour.

The exploit relies on three primary components:

• Untrusted input: The ability for the agent to ingest data from external, unauthenticated sources via forms.
• Rich content rendering: The agent’s capability to render links or images back to a user interface.
• Tool permissions: The agent’s underlying access to sensitive backend data and tools, such as the ‘Query Records’ tool.

Once triggered, the injected payload can use DNS-based exfiltration techniques to bypass Salesforce’s Trusted URLs redaction controls, which are intended to prevent unauthorised outbound data leakage through links.

Systemic Risks for AI Agents

Salesforce remediated the specific URL redaction bypass on 18 August 2026, following the initial report by Zenity Labs in June. However, the researchers emphasized that the underlying risk pattern is a systemic concern for the broader AI industry.

Zenity Labs warned that any AI agent that processes records from untrusted external sources while holding access to sensitive backend data and the capability to render rich content presents a latent path for prompt injection-driven exfiltration.