Lab Exposes New Agentforce Data Exploit

Cybersecurity experts discovered a way to pull sensitive account data from Agentforce without ever logging in or requiring the victim to click anything. A public Web-to-Lead form was used as the entry point, with a DNS query used as the exit. 

AI agent security provider Zenity Labs identified the three vulnerabilities, which it has collectively called ‘SalesBleed’, and reported them to Salesforce, which has now fixed the issues. Let’s take a look at what happened. 

What Is SalesBleed?

Zenity, which recently closed a $125M Series C funding round, revealed on September 24 that they had discovered the vulnerability. The SalesBleed attack capitalizes on Agentforce’s use of Salesforce CRM data – which can include external sources, like leads. 

The attacker submits an ostensibly benign lead to an organization through a Web-to-Lead endpoint with a hidden prompt injection in one of the fields. 

An internal user in that organization would later ask their agent something like “check my latest leads and help me with the newest one”, causing the agent to read the malicious lead – which contains instructions that the user did not intend to provide. These are:

1. Query the Accounts table using the same subagent’s Query Records tool.
2. Return a few fields like a company name and a deal size.
3. Paste the values as a subdomain string for the attacker-controlled hostname.
4. Print that URL back to the user as an HTML img src tag to generate a DNS query to the attacker-controlled DNS authoritative server.

The payload takes advantage of Agentforce’s tools permission within the General CRM subagent to access Leads and Accounts table data, then uses an exfiltration method through HTML image tags.

While Salesforce blocks untrusted URLs, encoding the data in the first-level domain of the hostname effectively bypassed this.

‘A Single Gap Can Change Everything’

Salesforce fixed the URL bypass method, but Zenity says that this kind of vulnerability is not specific to Salesforce. Any agent which reads records submitted by an external source, renders links to users, and also holds tool access to sensitive data has the “same ingredients”.

Michael Bargury, Zenity cofounder and CTO, told The Register that, while these attack chains have been fixed, the issues identified show the difficulties in controlling what agents can access, and what happens when they find a way around guardrails. 

Bargury said: “The bigger lesson here is about what it takes to keep AI agents contained. The idea of secure-by-design remains essential, but for agents it may no longer be enough. We can anticipate risks and build protections into an agent from the start, yet still miss edge cases and the different ways it might behave once it encounters the real world.”

Keeping agents constrained is a broader challenge than just this one incident, he added, referencing the OpenAI-Hugging Face incident where agents escaped the sandbox. 

“As AI agents get more powerful, we need to monitor them ever more closely to keep track of what they’re up to,” Bargury said. “Because even when we think they’re contained, a single overlooked gap can change everything.”