SalesBleed: Zero-Click Data Exfiltration From Salesforce Agentforce via a Poisoned Web-to-Lead Record

Zenity Labs (Alex Apostolov, Joao Donato, Avishai Efrat, Ayush RoyChowdhury) published SalesBleed on 24 September 2026. An attacker submits a lead through a public Salesforce Web-to-Lead form with a hidden prompt injection in one field; when an employee later asks Agentforce to review recent leads, the default General CRM subagent reads the lead and follows the injected instructions. Because that subagent can read both Leads and Accounts, it queries account data such as company names and deal sizes, encodes it into a subdomain of an attacker hostname and renders it as an image tag, so the client's DNS lookup leaks the data even where HTTP egress is blocked. Two parsing gaps in the Trusted URLs redaction layer let the URL through: an unrecognized TLD (.fun) and trailing curly braces that the redactor and the renderer handle differently. Agents published to Slack leak the same way through link unfurling. Zenity reported on 1 June 2026, Salesforce confirmed a fix on 18 August, and Zenity verified it on 19 August. No CVE was assigned and no in-the-wild exploitation is reported.

You are affected if you run Salesforce Agentforce (General CRM subagent, Trusted URLs redaction, Slack-published agents) before the August 2026 server-side fix..

Salesforce fixed the Trusted URLs bypass server-side, so no customer patch is needed. Treat externally submitted records such as Web-to-Lead leads as untrusted input to agents, and scope subagents so that one agent does not hold read access to both untrusted inbound data and sensitive objects like Accounts. Restrict rendering of external images and links in agent output, including Slack unfurling for published agents. Do not rely on output redaction alone, and monitor public lead-capture endpoints for injection-style payloads.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Salesforce Agentforce and which version, then enforce a policy on it.