Reported by 4 outlets

Timeline

1. original reporting

   Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection

   gbhackers.com · 18d ago · September 25th, 2026

   Security researchers have revealed a vulnerability chain known as “SalesBleed,” associated with Salesforce’s Agentforce. This vulnerability could allow attackers to extract sensitive CRM data through an indirect prompt injection embedded in a public Web-to-Lead form. The attack does not require a Salesforce login or a click from the victim and could leak data via DNS […] The post Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from labs.zenity.io

   SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce

   labs.zenity.io · 20d ago · September 24th, 2026

   Original Zenity Labs disclosure of the SalesBleed chain, published one day before the story's first coverage. A hidden prompt injection in a lead submitted through the public Web-to-Lead endpoint stays dormant until an employee asks Agentforce to review the newest lead, then steers the General CRM subagent's Query Records tool from Leads into Accounts and leaks values through an HTML img src tag whose hostname encodes the data in a DNS query to the attacker's authoritative nameserver. The Trusted URLs redaction layer was bypassed by combining a fixed TLD allowlist that missed .fun with termination characters (curly braces, square brackets) that the redactor and the chat renderer parsed differently, and redaction ran after the agent generated its output. Zenity reported the chain to Salesforce on June 1, 2026, confirmed the fix on August 19, 2026, and notes a DNS label caps at 63 characters and a full name at 253, so data leaves in continuous bleeding queries that survive HTTP egress controls.

3. update from labs.zenity.io

   SalesBleed: Hijacking Agentforce in Slack for Anonymous Phishing Attacks

   labs.zenity.io · 20d ago · September 24th, 2026

   Companion Zenity Labs post covering the third SalesBleed flaw, in the Agentforce-Slack integration, enabling identity impersonation for phishing with no attacker account to trace. It also describes a second no-click exfiltration path: for agents published to Slack, Slack's link-preview unfurling automatically crawls any raw URL the hijacked agent prints, so no image tag is needed and the fetch still hands the data to the attacker's DNS server.

4. update from securityweek.com

   ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration

   securityweek.com · 18d ago · September 25th, 2026

   Dubbed SalesBleed , the flaws could be exploited via Web-to-Lead forms, Salesforce’s official lead-collection mechanism, which also provides a direct path to the CRM. Malicious instructions injected into a Web-to-Lead lead would remain dormant until an employee asks an Agentforce agent to interact with the submission, causing the agent to process the poisoned lead and execute the hidden instructions. According to Zenity Labs, two of the SalesBleed bugs could be exploited in zero-click data exfiltration attacks, while the third allowed attackers to weaponize an Agentforce agent to distribute phishing messages. The first two flaws were caused by multiple weaknesses in Trusted URLs, the security mechanism designed to block Agentforce from displaying URLs and images from untrusted sources. “Agentforce reported that the content had been blocked by the organization’s security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server,” the company notes.

5. update from cyberpress.org

   Salesforce Agentforce Flaw Lets Attackers Steal CRM Data With Zero-Click Prompt Injection

   cyberpress.org · 18d ago · September 25th, 2026

   Zenity Labs reported that Salesforce investigated the findings after responsible disclosure and addressed the specific Trusted URLs bypasses used in the research. Salesforce Agentforce Flaw The vulnerabilities were reported on June 1, 2026, and Zenity later confirmed the fixes; Salesforce also said it found no evidence of exploitation in the wild. URL redaction layer was bypassed (Source: Zenity Labs) Salesforce Web-to-Lead forms are intentionally exposed to unauthenticated users, so prospective customers can submit contact details. According to Zenity , an attacker could place hidden instructions inside a lead field, creating a poisoned CRM record that remained dormant until an employee later asked Agentforce to review recent leads. A routine request, such as asking the agent to check the newest lead, could cause Agentforce to process attacker-controlled content. The injected instructions could then manipulate the General CRM subagent into invoking its existing Query Records capability against other accessible Salesforce objects, including Account records. This did not depend on privilege escalation ; the attack abused pe

6. update from labs.zenity.io

   A URL redactor only works if it agrees with the renderer on where a URL ends. SalesBleed (Zenity Labs): a Web-to-Lead injection fired when A

   labs.zenity.io · 16d ago · September 27th, 2026

   A URL redactor only works if it agrees with the renderer on where a URL ends.