Zero-Click Flaw in Salesforce's AI Agent Let Attackers Silently Steal CRM Data

Security researchers at Zenity Labs have disclosed an attack chain, dubbed 'SalesBleed', targeting Salesforce's Agentforce AI agent. Attackers could hide malicious instructions inside standard Web-to-Lead forms, a public-facing feature that lets external users submit data directly into CRM records. When Agentforce later processed that submitted record as part of normal operations, the hidden instructions would hijack the agent, prompting it to quietly extract sensitive data such as company names and deal sizes. The stolen data was exfiltrated using a DNS-based technique that bypassed Salesforce's built-in URL redaction safeguard.

What made this attack particularly dangerous is that it required no click from a victim, no stolen credentials, and no direct access to the target organisation. Simply submitting a form was enough to plant the payload, with the AI agent doing the rest during its routine work. Zenity reported the issue to Salesforce in June, and Salesforce fully patched the URL redaction bypass by August 18, resolving the vulnerability.

However, Zenity researchers warn the underlying risk is not unique to Salesforce. Any AI agent that processes records from untrusted external sources, displays rich content back to users, and has access to sensitive backend systems shares the same risk pattern, creating potential for similar prompt injection attacks in other AI-powered business tools.