Skip to content

Image: assets.infosecurity-magazine.com · rights & removal

Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk

Reporting by InfoSecurity MagazineRead the original at infosecurity-magazine.com

Objectivity score: 57 out of 100.
Difficulty 93 out of 100 (Quantum Electrodynamics)— Read Analysis

Executive Summary

Security researchers disclosed zero-click vulnerabilities in Salesforce Agentforce that permitted silent data exfiltration from customer relationship management systems without requiring victim interaction or attacker authentication. The vulnerability chain, termed 'SalesBleed,' involved planting prompt injection payloads within public Web-to-Lead forms to inject instructions into an Agentforce agent. This agent was configured to trust record content, allowing it to process embedded instructions that redirected its behavior. The attack leveraged the agent's access to sensitive tools and data permissions, enabling it to use DNS-based exfiltration techniques to steal account details like company names and deal sizes, bypassing URL redaction safeguards. Salesforce remediated the vulnerability on August 18 by fixing the URL redaction bypass. Furthermore, the research indicated that the underlying risk pattern exists in any AI agent that processes untrusted external inputs, renders rich content, and has access to sensitive data tools.

Facts Only

* Security researchers at Zenity Labs disclosed zero-click vulnerabilities in Salesforce Agentforce.
* The vulnerabilities allowed silent exfiltration of customer relationship management (CRM) data without victim interaction or attacker authentication.
* The attack chain was dubbed ‘SalesBleed.’
* Attackers could plant prompt injection payloads in public Web-to-Lead forms.
* Agentforce processed embedded instructions from these inputs.
* The attack combined prompt injection via Web-to-Lead, agent trust of record content for rendering links, and access to sensitive tool permissions.
* The injected payload instructed the agent to query and exfiltrate data using DNS-based exfiltration techniques.
* Salesforce fixed the URL redaction bypass on August 18.
* Researchers noted that the risk pattern is common in any AI agent processing untrusted input, rendering content, and holding sensitive tool access.

Full Take

The persistence of this threat highlights a critical assumption: that securing the perimeter of data systems (like Salesforce) is sufficient protection for advanced operational logic embedded within autonomous agents. The pattern observed—where seemingly benign features (Web-to-Lead forms) and intended functionality (AI agent interaction with record content) become conduits for systemic data leakage—suggests that vulnerabilities shift from direct access control to the implicit trust placed in autonomous processing flows. The core implication is that security must account not just for external access, but for the internal logic pathways agents use to interact with data. If an agent’s capability includes accessing sensitive tools, and it trusts data passed through channels like form submissions, the context of the input—even if technically "safe" from a direct injection standpoint—becomes the vulnerability vector for lateral data movement. The fix addressing URL redaction was specific, but the broader observation about the necessary ingredients remains relevant: any system integrating external, untrusted content with privileged execution capabilities requires a comprehensive re-evaluation of trust boundaries and context sanitization, irrespective of specific product patches. What systems are currently configured to rely on latent trust within autonomous workflows? What mechanisms exist to enforce context isolation when agent behavior spans data ingestion and external communication?

From the original · InfoSecurity Magazine

Security researchers at Zenity Labs have disclosed a set of zero-click vulnerabilities in Salesforce Agentforce that allowed attackers to silently exfiltrate sensitive data related to customer relationship management (CRM) without any interaction from the victim and without the attacker ever authenticating into the target's Salesforce environment.
Read the full story at infosecurity-magazine.com

Sentinel — Human

Confidence

The text reads like a factual summary of a technical security disclosure, exhibiting the clarity and specific detail typical of legitimate industry reporting rather than generative synthesis.

Signals Detected
low severity: Moderate sentence length variance; clear, technical exposition.
low severity: Strong logical flow from specific vulnerability to general pattern extrapolation.
low severity: Direct citation of specific dates and entities (Zenity, Salesforce fixes) suggesting grounded reporting.
low severity: Claims are highly technical and cite specific research/fixes; low risk of simple LLM confabulation.
Human Indicators
Specific attribution to a named research group (Zenity Labs) and precise timeline references strongly suggest sourcing from primary disclosure material.
Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk | Huntaegis