Enterprise AI-agent security firm Zenity Labs on 24 September 2026 disclosed SalesBleed, three chained flaws in Salesforce Agentforce that turned the platform's own Web-to-Lead intake form into a zero-click CRM data-exfiltration channel. Salesforce silently patched the bugs on 18-19 August 2026, but the write-up is the first public look at how they were chained.
An unauthenticated form, then DNS
The attack path: an unauthenticated attacker files a lead through the standard public Web-to-Lead form and embeds a prompt-injection payload in the message body; Agentforce's General CRM subagent — which by default has read access across both Leads and Accounts — later reads the lead when an internal rep asks a normal question about their own pipeline; the injected payload rides that read into a URL-redaction bypass and out to DNS, encoding the sensitive data inside DNS lookups over image tags or Slack URL unfurls. The victim never clicks anything.
Two edge cases in the URL redactor
Zenity's exploit slipped past Salesforce's Trusted URLs redactor by abusing two parsing edge cases: unrecognized TLDs (Zenity used .fun) weren't flagged as hostnames, and terminator characters (curly braces, square brackets) created a mismatch between how the redactor and the browser parsed the URL. Salesforce's fix, per the researchers, was to harden the Trusted URLs mechanism itself.
Second big Agentforce hit this year
SalesBleed lands months after Zenity's own $125M Series C from Norwest to build a security stack for what it argues will be a 1B AI-agents-in-production era, and days after Palo Alto Networks launched Continuous AI Defense with Claude Mythos and GPT-5.6-Cyber. Zenity's argument: any agent that combines an unauthenticated intake channel, a read-broad subagent and a lax URL redactor is one prompt-injection away from being a data-exfiltration engine.
Reporting based on coverage from Zenity Labs, SecurityWeek, Infosecurity Magazine and Forkast.