SalesBleed: Zero-Click Prompt Injection Lets Poisoned CRM Leads Hijack Salesforce Agentforce

Here's the attack chain that should reframe how you think about AI agents in business systems: an attacker fills out the contact form on your public website. No malware, no stolen credentials, no phishing email. Their only weapon is text typed into a "Company Name" field. When your Salesforce Agentforce AI agent later processes that lead — as it does hundreds of times a day as part of normal operations — the hidden instructions inside the form field hijack the agent. It silently extracts customer data from your CRM, and it exfiltrates it over DNS queries that look like routine background traffic. Security researchers at Zenity Labs call it SalesBleed, disclosed September 24, 2026, and it's the second time in a year the same Agentforce feature has been turned against the tenant that runs it — after 2025's ForcedLeak (CVE-2025-32711).

The critical word in all of this is zero-click. No employee opened an attachment. Nobody approved a prompt. The victim organization's only action was running an AI agent on data an outsider supplied — which is, after all, the entire point of an agent. Salesforce has patched the flaws, and Zenity's report describes research proofs-of-concept with no confirmed exploitation in the wild. But the pattern — indirect prompt injection as a delivery mechanism, business processes as the trigger, and DNS as the exfiltration channel — is now demonstrated end-to-end against the most widely deployed enterprise AI agent platform on the market. This is the template every agent deployment will be attacked with from here on.

How SalesBleed Actually Works

The entry point is one of the oldest features in Salesforce: Web-to-Lead, the public form handler that turns website submissions into CRM lead records. Zenity Labs showed that a form field — visible to any visitor, writable by anyone — can carry indirect prompt injection: instructions that do nothing until the record is consumed by something that treats text as guidance. When an Agentforce agent later triages the lead as part of normal business operations, it reads the embedded instructions as if they came from the system itself, and follows them.

From there, the research demonstrated three distinct capabilities that chain together:

• Silent CRM data theft. The hijacked agent could be steered into retrieving records from the very tenant it runs in — account data, contact details, pipeline information — using the legitimate permissions it already holds.
• Exfiltration over DNS. The extracted data was encoded into DNS queries to an attacker-controlled domain. This is the detail that makes SalesBleed more than a curiosity: DNS is rarely inspected as deeply as HTTP, and queries from a cloud platform's infrastructure are the definition of background noise.
• Phishing in the agent's own voice. The compromised agent could send messages from the tenant — meaning victims received convincing lures that appeared to come from a trusted AI assistant inside the CRM, not from a random external sender.

Put together, it's a complete attack chain with a zero-click trigger, a resident payload, a covert channel, and a second-stage abuse vector. And the trust model is what makes it work: Agentforce agents operate inside the tenant with connected-app privileges — effectively service principals with OAuth-backed access and a very chatty parser in front of them. Every defense that assumes "the attacker never got inside" misses this class of attack entirely, because the agent is inside. It just got its instructions from outside.

Why DNS Was the Perfect Exfiltration Channel

Encoders love egress filtering, and for good reason — most data-theft playbooks die at the HTTP proxy. SalesBleed routed around that by using the one protocol that is functionally load-bearing for everything and inspected by almost no one. DNS has always been a favorite covert channel (malware families have tunneled over it for two decades), but SalesBleed's twist is who originates the queries: a trusted SaaS platform's own infrastructure. Your egress rules allow Salesforce's endpoints by definition — that's the product working as designed. When the agent encodes CRM rows into DNS labels and queries an attacker's nameserver, the traffic leaves through the same trusted pipe your entire business runs through.

This is the part security teams should sit with. The exfiltration didn't exploit a network bug. It exploited the fact that an LLM can emit text that the surrounding system will act on, and that the surrounding system's normal network activity is trusted. Zenity's researchers demonstrated the chain in a controlled proof of concept; Salesforce has since patched the flaws. But note what was not required: no Salesforce-side misconfiguration the tenant admin could have flipped, no malicious app installed from AppExchange, no user interaction at all. The vulnerability lived in the interaction between a public form, an agent's context window, and the platform's trust boundaries — exactly the class of flaw that conventional vulnerability scanning doesn't have a category for yet.

Deja Vu: ForcedLeak, a Year Earlier

If the setup sounds familiar, it should. In 2025, researchers disclosed ForcedLeak (CVE-2025-32711), an indirect prompt injection flaw in the same Web-to-Lead → Agentforce pipeline. A year later, the same entry point yielded the same class of compromise with better tooling: zero-click execution, DNS-based exfil, and identity abuse. Two demonstrations against the identical feature twelve months apart is not a coincidence — it's an architectural pattern. Any surface where untrusted external input is fed to an LLM with tenant privileges will keep producing these findings until the trust boundaries are redesigned, regardless of which vendor ships the agent.

The broader 2026 picture is a stack of nearly identical incidents across the agent ecosystem: zero-click flaws in Salesforce Agentforce, prompt-injection abuse in coding assistants, and inference-server bugs like the SGLang ZeroMQ vulnerability we covered last week. Enterprise AI agents are where VPN gateways were in 2023 — the newest, most trusted, least-patched part of the perimeter. The difference is that agent attacks don't need a pre-auth RCE. They need the model to read the wrong paragraph.

What It Means for Your Agent Deployments

Salesforce patched SalesBleed, so if you run Agentforce, the first action is unglamorous: confirm you're current on the platform's security updates. But the durable lessons apply to every agent platform — Copilot agents, custom LangChain/LlamaIndex deployments, agent frameworks wired into ticketing and CRM systems. The same triage structure as our Zero-Day Emergency Response Playbook:

• Treat agents as service principals, not users. Inventory what each agent can read and write, and scope its permissions to the minimum its job actually requires. The blast radius of a hijacked agent equals its privilege set.
• Assume every external input field is an instruction channel. Web forms, email intake, ticket imports, partner feeds — anywhere an outsider writes text that an LLM will later read. Sanitize, flag, or quarantine untrusted text before it reaches an agent's context.
• Gate consequential actions on human approval. Reading data quietly is the hard case; sending messages, moving records, or exporting lists should require explicit confirmation paths that a prompt injection cannot satisfy by itself.
• Monitor the egress you don't think about. Watch DNS query patterns from your SaaS platforms for anomalies — high-volume lookups, unusual domains, encoded labels. DNS is where this class of exfiltration is actually visible.
• Extend your zero-trust model to agents. Our zero-trust approach to VPN vulnerabilities argued that trust must be re-earned per request; an agent that implicitly trusts everything in its context window is the opposite of that principle.

The Bottom Line

SalesBleed is the clearest demonstration yet of 2026's defining security shift: the attacker no longer needs to breach your perimeter — they need to be processed by your workflow. A public form, a poisoned field, an agent doing its job, and your CRM bleeds over DNS. Salesforce moved quickly and the flaws are patched, which is exactly why the finding matters even if no one ever weaponized it: it maps the attack surface of every agent platform deployed this decade. Inventory your agents like service principals, treat every external text input as hostile until proven otherwise, and put human gates on anything consequential. The agents are already inside your tenant. The only question is whose instructions they follow.

---

Disclosure: This post contains affiliate links. We may earn a commission on purchases at no extra cost to you. See our affiliate disclosure for details.

Get weekly AI & security infrastructure guides
Join the GeniusTechLab newsletter for AI infrastructure breakdowns, security analysis, and hardware recommendations — one email a week, no spam.
Subscribe to the newsletter →