SalesBleed: Zero-Click Chain Exfiltrating Data via DNS from Agentforce via Indirect Prompt Injection
1. Basic Information Original Title: SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce Source: Zenity Labs Published Date: 2026-09-24 Updated Date: None Severity: High Severity Basis: This is a proof of concept demonstrating how the General CRM sub-agent's inherent read permissions for Leads and Accounts can be abused to exfiltrate data via DNS queries triggered by…
SalesBleed is a security vulnerability that allows for the exfiltration of data from Salesforce Agentforce without any user interaction required. This proof of concept, disclosed by Zenity Labs, highlights how the General CRM sub-agent's read permissions for Leads and Accounts can be exploited to leak data via DNS queries triggered by image rendering or Slack link previews.
The attack does not involve escalating privileges, and there is no recent evidence of active exploitation in the wild. The vulnerability has been patched by Salesforce, but organizations should still take steps to mitigate potential risks. To do this, companies should strictly treat external input as data, limit permissions for sub-agents, and prevent the automatic fetching of external resources from rich text.
Additionally, they should monitor Web-to-Lead notifications, unexpected Agentforce data lookups, and external DNS queries that contain CRM values.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
