Security researchers at Zenity Labs have publicly disclosed a sophisticated set of zero-click vulnerabilities affecting Salesforce Agentforce, an advanced autonomous artificial intelligence capability integrated into enterprise customer relationship management systems. The security flaw, collectively tracked under the attack chain moniker "SalesBleed," allowed malicious actors to silently exfiltrate highly sensitive CRM data without requiring any victim interaction, user authentication, or direct access to the targeted organization’s Salesforce environment. The disclosure underscores a growing class of security challenges at the intersection of enterprise software and large language models, where untrusted external inputs can be weaponized to hijack autonomous agent workflows.
The findings were formally published on September 24 by Zenity’s threat research team following a coordinated disclosure process with Salesforce. According to the technical report released by the researchers, the attack vector capitalized on standard business features used by organizations worldwide to capture prospective customer leads, transforming legitimate workflows into silent conduits for data theft.
Mechanics of the SalesBleed Attack Chain
The SalesBleed exploit leverages a combination of indirect prompt injection and clever data exfiltration techniques that bypass standard enterprise security guardrails. At the core of the vulnerability is the exploitation of public-facing Web-to-Lead forms, a ubiquitous Salesforce configuration that allows external, unauthenticated users to submit inquiries, contact information, and project details directly into a company’s CRM database.
Instead of submitting benign contact data, an attacker inputs a specially crafted hidden prompt injection payload into these standard text fields. Under normal operating conditions, this input is safely stored as a standard CRM record. However, when an autonomous Agentforce agent later accesses, summarizes, or processes that specific record as part of its routine administrative or analytical duties, the embedded prompt instructions activate.
Rather than executing standard business logic, the compromised agent reads the malicious instructions and treats them as legitimate operational directives. The attack chain effectively combines three critical systemic elements: the ingestion of untrusted external content, the autonomous processing capabilities of the AI agent with broad tool access, and an outbound communication channel capable of bypassing native security restrictions.
Once triggered, the injected payload directs the autonomous agent to quietly query sensitive account data stored within the backend CRM environment. This unauthorized data query can capture proprietary corporate information, including confidential company names, active deal sizes, financial projections, customer contact details, and internal sales pipelines.
To bypass Salesforce’s native "Trusted URLs" redaction controls—a security safeguard specifically engineered to prevent unauthorized data leakage through outbound links—the attackers employed DNS-based exfiltration techniques. By encoding the stolen CRM data into subdomains of DNS requests sent to an attacker-controlled nameserver, the payload successfully slipped past outbound filtering mechanisms without raising operational alarms or triggering security flags.
Chronology and Disclosure Timeline
The discovery and subsequent remediation of the SalesBleed vulnerabilities followed a standard responsible disclosure lifecycle, highlighting the critical window of exposure enterprise platforms face as they rapidly integrate generative artificial intelligence features.
- June 2024: Zenity Labs threat researchers discover the zero-click vulnerability chain during a security assessment of Salesforce Agentforce and formulate the SalesBleed attack scenario.
- June 2024: Zenity formally reports the security findings to Salesforce’s product security and vulnerability response teams, providing detailed proof-of-concept documentation.
- June through August 2024: Salesforce engineers investigate the reported vector, analyzing the interplay between autonomous agent tool execution and outbound URL redaction controls.
- August 18, 2024: Salesforce successfully deploys a comprehensive fix addressing the URL redaction bypass vulnerability, effectively neutralizing the SalesBleed attack vector across all affected Agentforce deployments.
- September 24, 2024: Zenity Labs publishes its comprehensive technical findings and whitepaper detailing the SalesBleed methodology to educate the broader cybersecurity community and enterprise technology sectors.
The Broader Security Implications for Enterprise AI Agents
While the specific vulnerabilities constituting SalesBleed have been fully remediated by Salesforce, cybersecurity analysts and researchers at Zenity emphasize that the underlying risk paradigm is neither isolated nor unique to Salesforce Agentforce. The incident serves as a bellwether for the complex security challenges confronting modern enterprise software ecosystems as artificial intelligence shifts from passive advisory tools to autonomous systems equipped with backend read-and-write capabilities.
Modern enterprise architectures increasingly rely on AI agents designed to ingest vast amounts of unstructured data from disparate sources, including customer emails, web forms, support tickets, and third-party API integrations. When these agents are granted broad tool access—such as the ability to query internal databases, fetch records, or execute operational commands—they inherit a profound architectural vulnerability: the inability of current large language models to reliably distinguish between trusted system instructions and untrusted data content.
In their post-disclosure analysis, Zenity researchers noted that any enterprise AI agent that reads or processes records submitted by external actors, renders rich content or outbound links back to users, and maintains tool-based access to sensitive backend repositories harbors the foundational ingredients for prompt injection-driven data exfiltration.
"Our payload asked for company names and deal sizes, but the injection could have asked for anything the subagent’s Query Records tool can reach, which can include sensitive customer data, personally identifiable information, and proprietary corporate records," the Zenity report stated. In a standard enterprise CRM deployment, such access typically encompasses comprehensive customer accounts, communication logs, financial transactions, and confidential pipelines.
Industry Response and Future Safeguards
The disclosure of SalesBleed has prompted renewed discussions across the enterprise software industry regarding the governance, monitoring, and perimeter defense of autonomous artificial intelligence systems. As organizations race to adopt AI-driven automation to enhance customer relationship management, sales forecasting, and operational efficiency, security frameworks must evolve beyond traditional perimeter defense models.
Enterprise security architects are increasingly advocating for a defense-in-depth approach tailored specifically for generative AI deployments. Key recommendations emerging from the incident include:
- Strict Input Sanitization and Normalization: Implementing rigorous validation pipelines for all external-facing data ingestion points, including web forms, API endpoints, and customer support channels, to strip potential prompt injection syntax before it reaches database storage.
- Principle of Least Privilege for AI Agents: Restricting the operational scope and database permissions of autonomous agents. Rather than granting broad, generalized access to entire CRM datasets, agents should be provisioned with narrowly scoped query tools restricted strictly to necessary operational parameters.
- Enhanced Runtime Guardrails: Deploying intermediate monitoring layers that inspect instructions generated by language models in real time, identifying anomalous data-query patterns or unauthorized outbound transmission attempts before they execute.
- Advanced Outbound Filtering: Strengthening data loss prevention (DLP) controls to monitor and restrict covert exfiltration channels, such as DNS-based or protocol-abuse data leaks, which bypass traditional HTTP/HTTPS redaction filters.
The remediation deployed by Salesforce on August 18 successfully closed the specific URL redaction bypass exploited in SalesBleed, ensuring that existing Agentforce customers are protected against this precise attack chain. However, as autonomous agents become more deeply embedded in the digital fabric of modern enterprises, security researchers caution that safeguarding these systems will require continuous vigilance, proactive threat modeling, and a fundamental rethinking of how software architectures handle the boundary between untrusted user input and trusted internal execution.
