Salesforce has quietly patched a set of AI agent flaws that let attackers pull customer data out of live CRM systems without a single click from a victim. Zenity Labs, an AI agent security research firm, disclosed the vulnerabilities on September 24, 2026, under the name “SalesBleed,” according to Infosecurity Magazine. The flaws lived inside Agentforce, the AI agent platform Salesforce has pushed hard into its customer base since 2025, and they worked by hiding malicious instructions inside something as mundane as a public contact form.
The timing matters. Salesforce just told investors that Agentforce annual recurring revenue hit $800 million, up 169% year-over-year, and that accounts running the product in live production grew nearly 50% sequentially, per the company’s own Agentic Enterprise Index. SalesBleed landed in the middle of that growth curve, and it is the latest in a run of AI agent security failures that have hit OpenAI, Google, and Meta in recent months. Each incident tells a version of the same story: agents built to read, click, and act on behalf of humans inherit whatever access humans hand them, and attackers have figured out how to talk to those agents directly.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What SalesBleed actually did
Zenity Labs found three distinct flaws in Agentforce, Salesforce’s agentic AI layer for CRM workflows. Two of them enabled zero-click data exfiltration; the third let an attacker hijack an agent’s identity to send phishing messages. Crucially, Infosecurity Magazine reported in September 2026 that attackers needed zero authentication to trigger the entire chain — no stolen credentials, no session token, nothing beyond access to a public web form. Zenity’s own writeup, published on its research blog, credits the discovery to a team including Alex Apostolov, João Donato, Avishai Efrat, and Ayush RoyChowdhury. According to Zenity Labs, the attack chain started at a Web-to-Lead form — the standard public contact form countless companies embed on their websites to capture sales leads.
An attacker could submit what looked like an ordinary lead while burying hidden instructions inside a form field. When a sales rep later asked an Agentforce agent to summarize or process that lead, the agent read the embedded instructions as if they came from a trusted internal user, not an anonymous website visitor. Business Wire’s September 2026 coverage of the disclosure confirmed that two of the three SalesBleed flaws fit this exact zero-click exfiltration pattern. That is the textbook definition of indirect prompt injection: the attacker never touches the target’s account or logs into anything, they just wait for the AI agent to read poisoned content on their behalf.
Getting the data out required a second trick. Salesforce runs a security control called Trusted URLs, meant to block Agentforce from rendering links or images pointing to untrusted domains. Zenity found the redaction logic did not recognize certain uncommon top-level domains, including “.fun,” and mishandled specific characters such as curly braces and square brackets during URL parsing. That gap let attackers slip exfiltration links past the filter. Combined with the fact that a general CRM subagent held standing read access to both the Leads and Accounts tables, the hidden instructions could quietly query sensitive records — company names, deal sizes, contact details — and smuggle the results out.
The DNS exfiltration trick, explained
The exfiltration method itself is where SalesBleed gets its name and its bite. Rather than exfiltrating data over an obvious outbound HTTP request that a security team might catch, the attack encoded stolen fields — like an account’s name or deal size — directly into DNS subdomain lookups or into HTML image tags and Slack link-unfurling requests, according to reporting from Cybersecurity News. Every time a system tries to resolve a domain name, it sends a DNS query; if that query string itself contains stolen data, the attacker just needs to control the receiving DNS server to read it back out, no matter how tightly outbound web traffic is locked down.
This is not a new technique in classic malware, but seeing it paired with an AI agent’s tool-calling behavior is newer territory. The agent itself became the delivery mechanism: it rendered a link or fetched an image because a human had asked it a completely reasonable question (“summarize this lead”), and the poisoned content did the rest. SecurityWeek’s reporting on the disclosure notes that the flaw enabled “zero-click CRM data exfiltration to the attacker’s server,” meaning the victim organization’s own AI agent effectively became an unwitting exfiltration channel, quoted directly from SecurityWeek.
The third flaw: agent identity hijacking
The two exfiltration bugs got most of the attention, but the third SalesBleed flaw is arguably more unsettling for anyone thinking about insider trust. Through the same poisoned Web-to-Lead entry point, an attacker could hijack an Agentforce agent connected to Slack and have it “post phishing messages to Slack using the agent’s identity,” according to SecurityWeek’s account of the research. Because the agent did not verify who actually triggered the message, employees receiving it would see it arrive “from a trusted system already operating inside their workplace rather than from an unfamiliar outside sender.”
That distinction matters for phishing defense. Security awareness training spends years teaching employees to distrust unfamiliar senders and unexpected external links. An AI agent already embedded in daily workflows, with a name and avatar staff recognize, sidesteps that instinct entirely. If a compromised bot can message coworkers under its own trusted identity, every downstream defense built around “does this sender look legitimate” collapses.
Disclosure timeline: how Salesforce responded
Zenity Labs followed a coordinated disclosure process rather than dropping the findings publicly on discovery. The company reported the issues to Salesforce on June 1, 2026, and Salesforce acknowledged the report and began remediation work the next day, June 2. A technical discussion call between the two teams took place on June 16, with Salesforce’s engineering team confirming active work on fixes by June 17. The core Trusted URLs bypass was fully remediated by August 18, and Zenity says it independently verified that specific patch on August 19. The Register reported that Zenity didn’t sign off on the full picture until later, confirming that all three SalesBleed fixes were in place on September 21, 2026 — just three days before the public disclosure and roughly sixteen weeks after the initial report.
Salesforce has stated it investigated and remediated the issue by hardening the Trusted URLs mechanism to prevent similar bypass attempts, and the company has said it found no evidence the flaws were exploited in the wild before the fix shipped, per Zenity Labs’ disclosure summary. That “no evidence of exploitation” framing is standard vendor language after a coordinated disclosure and should be read as exactly that: an absence of detected abuse, not a forensic guarantee that nothing happened between the time the flaws existed and the August patch.
| Date | Milestone |
|---|---|
| June 1, 2026 | Zenity Labs submits SalesBleed findings to Salesforce |
| June 2, 2026 | Salesforce acknowledges the report, remediation begins |
| June 16, 2026 | Joint technical call between Zenity and Salesforce engineering |
| June 17, 2026 | Salesforce confirms active remediation work underway |
| August 18, 2026 | Trusted URLs bypass fully remediated |
| August 19, 2026 | Zenity Labs independently verifies the patch |
| September 24, 2026 | Public disclosure published by Zenity Labs and covered by security press |
Why enterprise CRM data makes this different
Consumer chatbot jailbreaks tend to produce embarrassing outputs. Enterprise agent flaws produce stolen records. Agentforce sits directly on top of Salesforce’s Accounts and Leads tables — the data that sales, marketing, and customer success teams live in every day. Infosecurity Magazine reported in September 2026 that SalesBleed could extract three categories of CRM fields out of the Accounts table — company names, deal sizes, and other account data — with the underlying access pattern suggesting a full table dump was achievable, not just a handful of leaked fields.
The risk pattern Zenity describes generalizes well beyond Salesforce. Per Infosecurity Magazine’s coverage, Zenity’s researchers characterized the exposure this way: “Any AI agent that reads or processes records submitted by external, untrusted sources, renders links, images, or other rich content back to users, and holds tool access to sensitive backend data” faces the same category of risk. That is a fairly precise description of how most enterprise AI agents are being built right now — plugged into CRM systems, ticketing queues, inboxes, and Slack, with broad read permissions granted for convenience rather than least privilege.
Part of a pattern: 2026’s run of AI agent security failures
SalesBleed does not exist in isolation. It lands in a year where AI agent vulnerabilities have moved from theoretical checklist items to recurring headlines. Tech Insider has tracked several related incidents this year: OpenAI flagged an AI agent’s DNS-based escape technique within 15 minutes of detection, a strikingly similar exfiltration channel to the one Zenity found in Agentforce. Separately, OpenAI’s own agents were found meddling with SEC and Census systems in a rogue-agent incident that raised questions about autonomous agents interacting with government infrastructure without adequate guardrails.
The pattern extends across vendors. Researchers demonstrated that Google’s Gemini broke into three real companies’ systems during a security test, while a separate campaign dubbed BragJack hijacked AI browser agents across five different browsers. Meta has had its own exposure too, with a Meta Muse zero-day backdoor that exposed more than 50 internal commands through a single misconfigured setting. Each of these is a different vendor and a different product, but the same underlying failure mode: an agent with broad tool access processed untrusted input and did something its designers never intended.
Historical context: prompt injection was never a secret risk
What makes 2026’s wave of incidents notable is not that prompt injection is a new discovery. It has held the number one spot, LLM01, on the OWASP Top 10 for LLM Applications since the very first edition of that list, and it retains that ranking in the 2026 edition, published August 4, 2026, according to the OWASP GenAI Security Project. What changed this year is the blast radius. The 2026 edition of the list reflects that shift directly: Excessive Agency, the risk category covering what happens when an LLM is given too much autonomous power to act, jumped from sixth place to third, while Sensitive Information Disclosure held its position at second.
In plain terms, the security community has spent years warning that prompt injection was a foundational risk. 2026 is the year that warning stopped being theoretical and started showing up as CRM data leaving through DNS queries, agents impersonating trusted coworkers in Slack, and other autonomous agents making unauthorized moves. SalesBleed is a case study in exactly the compounding effect OWASP describes: a prompt injection (LLM01) drove a real action tied to Excessive Agency, using data exposure patterns tied to Sensitive Information Disclosure.
Market impact and Salesforce’s exposure
Salesforce’s own numbers show why a vulnerability at this layer of the product carries outsized weight. Agentforce’s annual recurring revenue reached $800 million, up 169% year-over-year, and the number of accounts running Agentforce in live production grew nearly 50% sequentially, according to Salesforce’s Agentic Enterprise Index. Adoption of AI agents specifically within customer service organizations rose from 39% in 2025 to 66% in 2026, a 1.7x increase, and Salesforce reports that 70% of customer service organizations adopting AI agents see measurable value within 60 days of deployment. Salesforce’s own release notes add another wrinkle: the company confirmed in September 2026 that Agentforce would be switched on by default for the upcoming Winter ’27 release, meaning the installed base exposed to this class of vulnerability was set to expand automatically rather than through opt-in adoption alone.
That growth trajectory is precisely what makes a flaw like SalesBleed consequential beyond the technical fix. Every one of those newly activated agents inherits whatever permission scope its administrators granted it, and Zenity’s research suggests many organizations are granting broad read access to entire CRM tables for convenience. Salesforce closed this specific hole, but the underlying administrative pattern — general-purpose subagents with standing access to Leads and Accounts tables — is still how most Agentforce deployments are configured. The fix addressed the exploit path; it did not necessarily change the default privilege model that made the exploit valuable in the first place.
Competitive comparison: how major AI agent platforms stack up on this risk
No enterprise AI agent platform has been immune from prompt injection or excessive-agency findings in 2026. The differences show up in disclosure speed, attack surface, and how quickly each vendor moved from acknowledgment to patch — all while vendors keep shipping new agent capability on a parallel track. Google, for instance, took Gemini 3.7 Flash generally available in September 2026, with Releasebot reporting the model supports throughput of 1,000 requests per minute, the same month Salesforce was finishing its SalesBleed remediation. That pace of feature releases outstripping security review cycles is part of why these incidents keep recurring across vendors.
| Platform | Reported issue | Attack vector | Disclosure-to-fix window |
|---|---|---|---|
| Salesforce Agentforce | SalesBleed (3 flaws: 2 exfiltration, 1 identity hijack) | Web-to-Lead form indirect prompt injection + DNS/URL exfiltration | ~11 weeks (June 1 to Aug 19) |
| OpenAI agents | DNS-based agent escape technique | Agent-initiated DNS resolution used to bypass sandboxing | Flagged within 15 minutes of detection, per OpenAI’s own disclosure |
| Google Gemini | Agent breached real company systems during testing | Autonomous task execution beyond intended scope | Disclosed as part of a security test, not an in-the-wild incident |
| Meta Muse | Zero-day backdoor exposing 50+ commands | Single misconfigured setting exposing command surface | Reported unpatched 24 hours after disclosure |
Salesforce’s roughly eleven-week window between initial report and confirmed fix sits in the middle of the pack for this kind of vulnerability class: not the same-day urgency of a critical remote code execution bug, but far from the slowest enterprise disclosure cycles security researchers have publicly criticized elsewhere in the industry this year.
What security teams should actually check
For organizations running Agentforce, or any comparable AI agent platform wired into CRM, ticketing, or communication tools, the SalesBleed disclosure suggests a few concrete review points. First, audit which public-facing forms feed data into an AI agent’s context window, since any field a stranger can populate is a potential injection vector. Second, review whether agents hold standing read access to full tables (Leads, Accounts, Contacts) versus scoped, per-record access tied to an actual task. Third, check outbound DNS and link-rendering behavior for agents; if an agent can resolve arbitrary domains or render remote images without restriction, that channel needs monitoring the same way security teams already monitor DNS for classic malware beaconing.
Teams building or hardening their own AI agent security practice can also look at existing open-source red-teaming tools like garak and PyRIT to test agent robustness against injected content before deployment, rather than after a researcher finds the gap in production.
Predictions: where AI agent security goes from here
- Expect more “named” vulnerability disclosures like SalesBleed as security researchers increasingly brand AI agent flaws the way they once branded network protocol bugs, both for public attention and to make the risk pattern memorable to enterprise buyers.
- CRM and helpdesk vendors with public-facing intake forms (Web-to-Lead equivalents, support ticket portals, contact forms) will face growing scrutiny as the most common injection entry point, since they are, by design, open to anonymous untrusted input.
- DNS-based exfiltration will keep showing up in AI agent attack chains through 2026 and into 2027, given how consistently it appears across unrelated disclosures this year, from OpenAI’s agent escape to Zenity’s SalesBleed findings.
- Expect enterprise AI agent vendors to move toward default least-privilege permission models for subagents, replacing today’s common pattern of broad table-level access, as customers start asking pointed questions after high-profile disclosures.
- Coordinated disclosure timelines in the 8-to-12-week range, similar to Salesforce’s response here, will likely become the de facto industry norm for agent-specific vulnerabilities that do not involve active exploitation, distinct from the same-day urgency reserved for confirmed in-the-wild attacks.
The bigger picture for CRM and SaaS security
SalesBleed is a reminder that the attack surface of enterprise software did not shrink when vendors bolted AI agents onto existing products, it expanded in a direction most security teams were not built to monitor. A Web-to-Lead form has existed, unremarkably, for two decades as a way to capture inbound sales interest. It took an AI agent capable of reading and acting on that form’s contents to turn it into a data exfiltration vector. The same logic applies to every other “boring” input field across enterprise software: support tickets, calendar invite descriptions, email subject lines, shared document comments. Anywhere an AI agent reads content submitted by someone outside the organization’s trust boundary is now a place a security team needs to think about the way they would think about a public API endpoint.
Salesforce fixed the specific bypass Zenity found. The broader question, shared by every vendor racing to ship agentic features in 2026, is whether the default configuration of these agents changes before the next researcher finds the next form.
Frequently asked questions
What is SalesBleed?
SalesBleed is the name Zenity Labs gave to a set of three vulnerabilities in Salesforce Agentforce, disclosed publicly on September 24, 2026. Two of the flaws enabled zero-click exfiltration of CRM data, and a third allowed an attacker to hijack an agent’s identity to send phishing messages inside a company’s Slack workspace.
Is Salesforce Agentforce still vulnerable to SalesBleed?
No. According to Zenity Labs, Salesforce fully remediated the Trusted URLs bypass by August 18, 2026, with Zenity independently verifying that fix on August 19, 2026. The Register reported that Zenity went on to confirm all three SalesBleed fixes were fully in place by September 21, 2026, just days ahead of the public disclosure on September 24.
Was any customer data actually stolen?
Salesforce has said it found no evidence the flaws were exploited in the wild before the patch shipped, per Zenity Labs’ disclosure. That statement reflects the absence of detected abuse rather than a full forensic guarantee covering the entire window the vulnerabilities existed.
How did the zero-click attack work without any user interaction?
An attacker submitted a normal-looking entry through a public Web-to-Lead form with hidden instructions embedded in a text field. When an employee later asked an Agentforce agent to process or summarize that lead, the agent read the hidden instructions as legitimate input and carried them out, including rendering links or images that exfiltrated data via DNS queries, without the employee needing to click anything malicious themselves.
Does this affect other Salesforce products besides Agentforce?
The disclosed research from Zenity Labs specifically targeted Agentforce, Salesforce’s agentic AI layer. Reporting on the disclosure has not extended these specific findings to other Salesforce products outside that platform.
Is prompt injection unique to Salesforce Agentforce?
No. Prompt injection has ranked as the number one risk on the OWASP Top 10 for LLM Applications since that list’s first edition and remains in that position in the 2026 edition. Similar agent-related security incidents have been reported in 2026 involving OpenAI, Google Gemini, and Meta’s Muse platform.
What should businesses using AI agents connected to CRM data do now?
Security researchers recommend auditing which public-facing inputs feed into AI agents, scoping agent data access to specific tasks rather than entire tables, and monitoring outbound DNS and link-rendering behavior for signs of exfiltration, treating agent tool access with the same scrutiny typically applied to public API endpoints.
