Security researchers have revealed a vulnerability chain known as “SalesBleed,” associated with Salesforce’s Agentforce. This vulnerability could allow attackers to extract sensitive CRM data through an indirect prompt injection embedded in a public Web-to-Lead form.
The attack does not require a Salesforce login or a click from the victim and could leak data via DNS queries triggered when an employee performs a routine request to an AI agent. Salesforce investigated these findings and took steps to remediate the reported vulnerabilities.
Salesforce Agentforce Flaw
According to Zenity Labs, the attack starts with a malicious submission to a company’s public Salesforce Web-to-Lead endpoint. These endpoints are intentionally unauthenticated to allow prospective customers to submit their contact details.
An attacker can embed instructions in a lead field that may appear harmless to the user but are interpreted as commands when Agentforce later processes the record.
The malicious payload remains stored in the CRM until an internal user asks Agentforce to review recent leads. For example, an employee might ask the agent to “check my latest leads and help me with the newest one.”
When Agentforce parses the attacker-controlled lead, the hidden instructions can prompt the General CRM subagent to use its Query Records capability to access other CRM objects, including the Accounts table.
Researchers demonstrated a scenario where the injected instructions caused the agent to retrieve data, such as account names and deal sizes, encode those values into an attacker-controlled subdomain, and return the URL in an HTML image tag. For instance, an agent might produce output that looks like this:
When the Agentforce chat interface renders the image, the client attempts to resolve the hostname. This DNS request can reach the attacker’s authoritative DNS server, exposing the data embedded in the subdomain. Importantly, the HTTP request itself is unnecessary for the theft to succeed; the data leaves the environment as soon as DNS resolution occurs.
The proof-of-concept also outlined a potential attack path through Slack. In Agentforce deployments published to Slack, an attacker-controlled URL could trigger Slack’s automated link-preview feature, causing a DNS lookup without requiring a user to open or click the link.
This is why researchers classify the issue as a zero-click attack: the employee performs a normal agent query while the data access and outbound resolution happen automatically.
Salesforce’s Trusted URLs mechanism aims to restrict external destinations and support Content Security Policy controls for Salesforce resources.
The company has enforced Trusted URL allowlists for Agentforce and Einstein Generative AI agents as a defense-in-depth strategy against outbound requests driven by prompt injections.
According to Zenity’s assessment of SalesBleed, researchers bypassed URL redaction by exploiting discrepancies between the redactor’s URL parsing and browser rendering behaviors. They combined a top-level domain that the redactor did not recognize with specific termination characters.
The URL filter treated the string as malformed. It allowed it through, while a browser processing an HTML image source still attempted hostname resolution.
SalesBleed highlights a recurring pattern in AI security: externally supplied content, broad tool permissions, and outbound communication channels under a single agent identity. The prompt injection did not require privilege escalation; instead, it abused existing data access granted to the CRM subagent.
The potential impact of this vulnerability depends on the objects and fields accessible through Agentforce tools. In a vulnerable configuration, an attacker could potentially retrieve information about accounts, contacts, pipelines, or other records that the agent can query.
Given that contaminated lead records persist, a single malicious submission could be triggered repeatedly whenever staff reviews that lead.
Salesforce stated it has strengthened the affected mechanisms, and separate reports indicate no evidence of exploitation in the wild. The company also updated default settings for certain Agentforce actions in Slack to require user confirmation before messages are sent.
Mitigation Steps
Organizations using Agentforce should:
- Review public Web-to-Lead forms and treat all submitted fields as untrusted AI input.
- Apply least privilege to Agentforce subagents, separating lead-review functions from sensitive account and contact access.
- Audit Trusted URL allowlists and avoid overly broad wildcard entries.
- Restrict or sanitize HTML and externally resolved content in agent responses.
- Monitor DNS telemetry for unusual high-entropy or data-like subdomains.
- Enable available Agentforce prompt-injection detection and review related reports and dashboards.
- Require confirmation for consequential actions, especially Slack messages and external requests.
This case illustrates that output filtering alone cannot effectively defend against such vulnerabilities.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
