Zenity's SalesBleed shows zero-click DNS exfiltration from Salesforce Agentforce

What the research shows

Security researchers at Zenity Labs have disclosed "SalesBleed," a zero-click data exfiltration chain against Salesforce's Agentforce that pairs indirect prompt injection with DNS-based exfiltration. According to the research, summarized in a dev.to write-up dated September 24, 2026, the technique was demonstrated in a controlled proof of concept, and Salesforce has since patched the reported chain.

How the attack works

The chain begins at Web-to-Lead, a standard Salesforce feature that lets unauthenticated visitors submit inquiries through public forms. An attacker plants prompt injection payloads in those submissions, which are stored as Lead records.

When an internal user later asks Agentforce a routine question about leads, the General CRM sub-agent — which by design holds read permissions for both Leads and Accounts — processes the stored record and follows the malicious instructions inside it. The agent then pulls values from Accounts and constructs URLs pointing at attacker-controlled domains, with the retrieved data encoded into the hostnames.

The exfiltration completes without any action from the victim. As the dev.to summary explains, when the response containing the crafted URL is rendered — either as an image loaded by the browser or as an automatic link preview generated by Slack — the client resolves the hostname. That DNS lookup transmits the encoded data to the attacker's DNS server, and it succeeds even when the follow-up HTTP request is blocked or never completes.

Zenity also documented a way around Agentforce's "Trusted URLs" filtering: pairing a top-level domain the URL redactor did not recognize, such as .fun, with trailing braces or brackets allowed the crafted URLs to pass through intact.

Timeline and scope

Zenity reported the issue to Salesforce on June 1, 2026. Salesforce confirmed the fixes on August 18, and Zenity verified that the Trusted URLs bypass had been closed on August 19.

The finding is rated high severity, but the write-up is careful about its boundaries. The chain abuses permissions the General CRM sub-agent already holds — no privilege escalation is involved — and it was demonstrated only in Zenity's research environment, with exploitation in the wild remaining unconfirmed. The write-up also notes that because malicious leads persist inside the CRM, ordinary queries after the initial submission can re-trigger the attack.

What administrators can check

The disclosure lists indicators for teams investigating exposure: lead records containing unusual external input, Account lookups that fall outside what the user actually asked, external URLs appearing in agent responses, and unusually long DNS labels under unfamiliar domains that appear to carry data. It cautions that SaaS audit logs may not record every read operation or Slack-side DNS activity, so an absence of local evidence does not rule the activity out.

Recommended defenses include treating all external input strictly as data rather than instructions, trimming the object and field permissions granted to sub-agents, preventing automatic fetching of external resources from rich text, and restricting outbound DNS and HTTP traffic to approved domains.

Why it matters

SalesBleed is a concrete illustration of the risk that comes with giving AI agents read access to business data and the ability to place URLs in their responses. The injection vector requires no authentication, the trigger requires no user interaction, and the exfiltration channel — DNS — survives defenses aimed at HTTP traffic. Even with the patch in place, organizations running Agentforce or comparable CRM agents should verify remediation and apply least-privilege and egress controls, because the underlying pattern, untrusted text steering an agent into emitting resolvable URLs, is not specific to Salesforce.