Zenity Labs Found Three Zero-Click Salesforce Agentforce Flaws That Could Leak CRM Data

Cybersecurity firm Zenity Labs disclosed three zero-click vulnerabilities in Salesforce Agentforce, collectively dubbed SalesBleed, in September 2026, all of which have since been patched. The attack exploited Salesforce's Web-to-Lead forms by embedding prompt injection payloads in publicly submitted form fields, which sat dormant in the CRM until an AI agent processed them. Because Salesforce's General CRM subagent already had read access to Leads and Accounts by design, no privilege escalation was needed — the attacker simply hijacked the agent's existing permissions. The agent was manipulated into encoding stolen deal and account data as subdomains in DNS queries, bypassing conventional HTTP-based data loss prevention and URL filtering tools. The disclosure highlights a broader security risk: AI agents that inherit broad data access can be weaponized through the very data they are trusted to process.