SalesBleed: zero-click CRM data theft through Salesforce Agentforce
A hidden instruction in a public lead form turned a CRM agent into a silent data leak.
· Zenity Labs · Research by Alex Apostolov, João Donato, Avishai Efrat, Ayush RoyChowdhury
SalesBleed is a Zenity Labs attack in which one web form lead carrying a prompt injection made Salesforce Agentforce leak Accounts data through DNS with zero clicks. Salesforce hardened its Trusted URLs filter in August 2026.
01What happened
Zenity Labs published SalesBleed on September 24, 2026, describing how an unauthenticated attacker could hijack Salesforce Agentforce and pull CRM data out with zero clicks. Zenity reported it to Salesforce on June 1, 2026, and validated the fix on August 19, 2026.
02How it works
The attacker submits a lead through the public Web-to-Lead form with hidden instructions. When an employee asks the agent about recent leads, it reads the injection, queries the Accounts table with its Query Records tool and builds an image URL whose subdomain carries the data. The URL slipped past the Trusted URLs redactor because it used an unrecognized top-level domain and characters like curly braces, and the browser's image load sent a DNS query to the attacker's nameserver. A second part shows the agent's Slack reply action could be used for anonymous phishing.
03Who is affected
Salesforce customers running Agentforce with the general CRM subagent, which in the default setup could read both Leads and Accounts. Salesforce says it has hardened the Trusted URLs mechanism.
04What to do
Treat Web-to-Lead and other public inputs as untrusted data, scope each subagent to the tables it needs, and review agent actions that write or send messages without confirmation.
Sources 2 links, all fetched
- 1labs.zenity.ioZenity Part 1
- 2labs.zenity.ioZenity Part 2: Slack