SalesBleed: indirect prompt injection enabled zero-click CRM data exfiltration on Salesforce Agentforce
2026-salesforce-agentforce-salesbleed · 2026-09-24
Zenity Labs disclosed three vulnerabilities in Salesforce Agentforce, collectively named SalesBleed. A prompt injection hidden in a public Web-to-Lead submission stayed dormant until an employee asked an Agentforce agent about recent leads; two of the flaws then let the agent silently exfiltrate CRM data via a Trusted URLs redaction bypass, and a third let the agent post phishing messages under its own identity. Salesforce fixed all three; no exploitation in the wild was reported.
System
- Framework
- Salesforce Agentforce (General CRM subagent, Query Records tool)
- Tools
- web-to-lead, query-records, slack
- Vendor
- Salesforce
- Autonomy
- supervised-autonomous
Classification
- Primary class
- prompt-injection
- Chain
- prompt-injection/indirect → data-exfiltration/via-output
- Attack vector
- untrusted-content
- Causation
- entity: human · intentionality: intentional · timing: post-deployment
Trigger
An unauthenticated party submitted a lead through a public Web-to-Lead form with prompt-injection instructions hidden in the lead fields. The record stayed dormant until an employee asked their Agentforce agent a routine question about recent leads; the agent read the poisoned record and executed the hidden instructions, querying the Accounts table and emitting the retrieved data inside a crafted URL that the browser or Slack fetched automatically.
Root cause
Untrusted third-party content entered the agent's trust boundary and was acted on as instructions, and the Trusted URLs redaction mechanism and the rendering surface interpreted the same URL string differently. Unrecognised top-level domains and URL-termination characters let an attacker-controlled URL carrying exfiltrated data pass redaction, while auto-loaded HTML images and Slack link unfurling fetched it with no user action.
Contributing factors
- Public Web-to-Lead endpoints accept external content by design, and poisoned leads persist in the database.
- The default General CRM subagent had read access to both the Leads and Accounts tables.
- Redaction and rendering layers parsed URLs differently, so a crafted URL bypassed the Trusted URLs allowlist.
- Auto-fetched images and Slack link unfurling provided zero-click outbound exfiltration channels.
Detection
Discovered and disclosed by Zenity Labs researchers (Alex Apostolov, Joao Donato, Avishai Efrat, Ayush RoyChowdhury), who named the chain SalesBleed and reported it to Salesforce on 2026-06-01.
Recovery
Salesforce hardened the Trusted URLs mechanism and updated default Slack message settings to require user confirmation. Zenity confirmed all three fixes on 2026-09-21; the full attack chain and bypasses no longer work. The work was a researcher proof of concept with no reported real-world exploitation.
Prevention
Separate untrusted retrieved content from instructions so lead data cannot act as commands; reconcile URL parsing between redaction and rendering layers; scope agent tool access so a lead-review agent cannot read unrelated sensitive tables; restrict outbound image and link-preview fetching; require confirmation before an agent posts under its own identity.
Blast radius
- Data
- CRM records reachable by the default General CRM subagent (company names, deal sizes, account and lead fields) could be silently exfiltrated to attacker-controlled infrastructure. confidential
- User harm
- Researcher proof of concept; Salesforce and Zenity reported no evidence of exploitation in the wild. The third flaw additionally allowed the agent to be used to deliver phishing messages under its own identity. none-reported
- Scope
- Agentforce tenants running the default General CRM subagent before the fix
- Reversibility
- irreversible
References
- OWASP LLM
- LLM01 LLM02
- MITRE ATLAS
- AML.T0024 AML.T0051
- Related
- 2025-echoleak-m365-copilot 2025-anthropic-slack-mcp-exfiltration 2025-claude-code-dns-exfiltration
- Tags
- zero-click prompt-injection data-exfiltration agentforce crm web-to-lead dns-exfiltration
Sources
Cite this incident
Permalink: https://swarmproof.github.io/agent-postmortems/2026-salesforce-agentforce-salesbleed/
@misc{2026-salesforce-agentforce-salesbleed,
title = {SalesBleed: indirect prompt injection enabled zero-click CRM data exfiltration on Salesforce Agentforce},
year = {2026},
howpublished = {agent-postmortems},
url = {https://swarmproof.github.io/agent-postmortems/2026-salesforce-agentforce-salesbleed/}
}