A single unauthenticated lead submitted through a standard Salesforce web form could hijack a company’s Agentforce AI agent well enough to siphon CRM data out through DNS lookups, with no employee clicking anything.
What happened
Security research firm Zenity Labs disclosed three vulnerabilities it collectively named SalesBleed in Salesforce’s Agentforce AI platform. According to Zenity’s published research, an attacker could plant hidden prompt-injection instructions inside a Web-to-Lead form, the standard Salesforce feature that lets external visitors submit data directly into CRM records. The payload stayed dormant until an employee’s Agentforce agent processed that lead as part of normal work. Two of the three flaws then let data escape without any user interaction at all: HTML image tags and Slack’s automatic URL-unfurling caused the agent to resolve attacker-controlled domains, leaking sensitive information encoded in DNS subdomain queries. The root cause, per Zenity, was a set of edge cases in Salesforce’s own Trusted URLs filter, including unrecognized top-level domains and inconsistent URL-termination parsing between the filter and the browser. A Zenity researcher put it plainly: “the injection didn’t need to escalate privileges, the permissions were already there.” Zenity reported the flaws to Salesforce on June 1, and Salesforce confirmed all three were patched by August 18.
Why it matters
Web-to-Lead forms are built to accept input from anyone, by design, which makes them a uniquely clean injection point into an AI agent that otherwise operates inside a trusted enterprise identity. Two of the three bugs required zero clicks from any employee, meaning standard phishing-awareness training offers no protection against this class of attack.
The insight
Agentforce was not insufficiently sandboxed; “trusted” inputs like the Web-to-Lead pipeline were treated as safe data for an agent that inherited the full read access of whichever employee identity processed them, the same non-human-identity blind spot CyberTech has argued enterprises leave unwatched. It echoes a pattern CyberTech found in a shared flaw across major AI coding agents: any agent acting on untrusted external data with an internal identity’s permissions needs its own sanitization layer, not one borrowed from browsers.
Source: Zenity Labs
