Salesforce Agentforce SalesBleed Beat the ForcedLeak URL Fix

Zenity Labs showed that a public Salesforce Web-to-Lead form could hijack Agentforce, steal CRM fields, and phish Slack, all without a click. The three chains, named SalesBleed, were tested as closed on September 21, 2026.

They used the same door ForcedLeak used in 2025, then walked around the Trusted URLs control Salesforce switched on to stop that earlier leak.

A Public Form With Hidden Instructions

Alex Apostolov and colleagues at Zenity Labs documented zero-click data exfiltration on Agentforce that never needed a Salesforce login. The attacker typed hidden instructions into a Web-to-Lead field, the same public form companies put on a website so strangers can become leads. The record sat in the CRM until someone on the sales team asked an agent a normal question, such as “check my latest leads and help me with the newest one.”

The agent read the poisoned lead as if those lines were part of the job. It used the Query Records tool inside the official General CRM subagent, pulled fields from the Accounts table, and packed a company name and a deal size into a hostname it printed back as an HTML image tag. The chat surface fetched that image with no extra tap, which forced a DNS lookup to a server the attacker controlled. Zenity’s proof-of-concept video walks an Accounts table out of a tenant, one record at a time.

A second path skipped the image tag when the agent lived in Slack. Slack builds link previews by crawling URLs as soon as they appear, so the same stolen fields could ride out in a preview fetch. The third flaw was not a leak. It let the agent post into Slack threads as itself.

THE THREE SALESBLEED FLAWS

None of this required the employee to open an attachment or follow a link the attacker sent. They asked their own agent about their own leads. Everything after that ran on defaults.

The Redactor Did Not Know.fun

Salesforce already had a control for this class of leak. Trusted URLs is supposed to strip untrusted links from agent output before anyone sees them, replacing a blocked address so the agent cannot point a browser, or Slack, at a stranger’s host. Zenity still got a usable URL through by stacking two gaps in how that layer spotted a link.

HOW THE 0-CLICK CHAIN RAN

• Plant the lead: A stranger submits a Web-to-Lead record with a hidden prompt in a text field, and the endpoint needs no account.
• Wait for review: The payload stays dormant until an employee asks Agentforce to work the newest leads.
• Reuse Query Records: The same General CRM subagent that reads Leads also reads Accounts, so the injection does not need a privilege bump.
• Leave through DNS: Stolen fields become a subdomain on an image tag or a Slack preview URL, and the lookup carries them out even if the later HTTP fetch fails.

The redactor only treated a fixed set of top-level domains as real hosts. The .fun TLD, which sits on the Interactsh out-of-band test platform as oast.fun, was not in that set, so a hostname ending there might not register as a hostname at all. The redactor and the surface that rendered the reply also disagreed on where a URL stops. Curly braces and square brackets let a string look broken to the filter and still work as an image source in the browser.

A sample that sailed through was a string in the shape of a URL ending in oast.fun with a brace-wrapped tail. That string is not a valid URI under RFC 3986, which is why the redactor left it alone, and it still produced the DNS query the attack needed. Redaction also ran after the agent had already written the reply, so the model never learned that part of its output was being cut, and the researchers could tune the payload against both the raw reply and the filtered copy.

Noma Bought a $5 Hole in the Allowlist

SalesBleed is the second time a public lead form has been used to turn Agentforce into a data pump. Noma Labs published the ForcedLeak chain in Agentforce in 2025 as a CVSS 9.4 finding. Researcher Sasi Levi’s team hid instructions in Web-to-Lead, waited for an employee to ask the agent about that lead, then had the model emit an image tag pointed at a domain that still sat on Salesforce’s content security allowlist even though it had expired.

That domain was my-salesforce-cms.com. Noma bought it for $5, stood up a listener, and watched CRM data arrive in a query string. Salesforce took the name back and, on September 8, 2025, began enforcing Trusted URL allowlisting for Agentforce and Einstein generative AI agents. Unapproved links were supposed to die there.

FROM FORCEDLEAK TO SALESBLEED

1. July 28, 2025: Noma Labs reports ForcedLeak to Salesforce.
2. July 31, 2025: Salesforce acknowledges the ForcedLeak report.
3. September 8, 2025: Salesforce starts enforcing Trusted URLs for Agentforce and Einstein generative AI agents.
4. September 25, 2025: Noma Labs publishes ForcedLeak.
5. February 28, 2026: Salesforce drops the default *.salesforce.com wildcard on the Agentforce allowlist.
6. June 1, 2026: Zenity Labs emails Salesforce the SalesBleed findings.
7. June 2, 2026: Salesforce confirms the reports and says it is working on fixes.
8. June 16, 2026: Zenity and Salesforce hold a technical call on the bugs and possible fixes.
9. June 17, 2026: Salesforce closes the disclosures and says engineering is working on a fix.
10. August 18, 2026: Salesforce confirms the Trusted URLs fixes.
11. August 19, 2026: Zenity confirms the reported Trusted URLs bypass is gone.
12. August 20, 2026: Zenity confirms Reply to a Slack Thread now names the invoking user.
13. September 21, 2026: Zenity tests all three fixes, including default confirmation on thread replies.
14. September 24, 2026: Zenity publishes both SalesBleed write-ups.

In the months between those two disclosures, Salesforce also removed the *.salesforce.com wildcard from the default Agentforce allowlist, a change it said was meant to cut prompt-injection risk from broad wildcards. SalesBleed did not need a wildcard hole. It needed the redactor to miss a hostname that did not look like a hostname, which is a different failure on the same control.

How Slack Turned the Agent Into a Phish

João Donato and the same Zenity team then showed the agent could send phishing messages using the agent’s identity. Agentforce publishes into Slack through subagents. Most Slack write actions they tested asked the user to confirm and stamped the invoking person on the message. Reply to a Slack Thread did neither.

Send a Slack Direct Message, in their tests, did both jobs. Thread reply could fire as soon as the agent chose it, and people in the channel saw a note from the agent with no pointer back to the human who set it off. A malicious insider who already talked to the agent could dictate a lure, let the bot search for the thread, and walk away. An outsider could hide the same order in a Web-to-Lead record and wait for a routine lead review to post it.

The URL-redaction bypass kept those phishing links intact, and markdown let a hostile address sit behind calm link text. A thread reply also arrives with context already attached, in a conversation about an account or a ticket, which is a better place to plant a link than a cold direct message. Zenity co-founder and CTO Michael Bargury said the containment problem is wider than this product.

The idea of secure-by-design remains essential but for agents it may no longer be enough. We can anticipate risks and build protections into an agent from the start, yet still miss edge cases and the different ways it might behave once it encounters the real world.

Michael Bargury, co-founder and CTO, Zenity

He pointed at the OpenAI-Hugging Face sandbox escape as another case where an agent left the box built to hold it, and said teams will have to watch what agents do after they ship, because one missed gap can change the outcome.

Default Subagents Already Held the Accounts Table

The injection never had to steal a higher role. Zenity wrote that the permissions were already there. The official General CRM subagent ships with read access to Leads and Accounts, which is how a lead review becomes an Accounts dump. Impact then tracks whatever else Query Records can see in that deployment, including contacts in a typical CRM setup.

WHAT THE DEFAULT SUBAGENT COULD REACH

• Leads and Accounts: The stock General CRM subagent could query both tables with the same tool.
• No extra login: Web-to-Lead is public on purpose, so there is no account to suspend and no session to revoke when a poisoned record lands.
• A durable foothold: The malicious lead stays in the table and can fire again every time someone reviews it, and more leads widen the channel.
• DNS after HTTP dies: Once the lookup runs, the later image request can fail, time out, or be blocked, and the fields have already left.

That mix is Simon Willison’s lethal trifecta for AI agents: private data, untrusted content, and a way to talk to the outside. Zenity’s version of the same three-part test is an agent that reads records submitted from outside, renders links or images back, and still holds tools that can touch sensitive rows. Output filters try to cut the third leg after the fact. They then have to beat every renderer downstream, including a browser image loader and Slack’s preview bot, and this time the parser lost.

The same shape shows up anywhere an agent reads a public intake form, a support ticket, or a resume and also holds a tool that can query private records or post into a trusted chat. SalesBleed is the Salesforce instance of that pattern, not a one-off parser joke.

A Single Click Still Turns Confirmation Off

Salesforce investigated with Zenity, hardened Trusted URLs, added attribution on Reply to a Slack Thread, and changed insecure Slack defaults so thread replies ask for confirmation. Zenity confirmed the Trusted URLs bypass was gone on August 19, 2026, saw attribution land on August 20, and on September 21 tested that all three paths were closed. The public write-ups followed on September 24.

The remaining trap is not a missing patch. It is a default. Zenity warned that user confirmation on that Slack write action turns off with one click, and that the old path can open again the moment someone disables it to keep the agent moving. Admins who ship Agentforce into Slack still have to leave that prompt on, and they still have to treat every public form that feeds the same agent as untrusted text, not as a clean CRM field.

The SalesBleed chains are closed in the default setup Zenity tested. The lead form is still public, and the confirmation switch still turns off with one click.

Frequently Asked Questions

What Is a Salesforce Web-to-Lead Form?

A Salesforce Web-to-Lead form is an unauthenticated public form companies embed on websites so strangers can become CRM leads. Noma Labs found the Description field accepts up to 42,000 characters, while First Name and Company are capped at 40 and Last Name and Email at 80, which is why a hidden instruction set fits in Description and not in the short fields.

How Much Stolen Data Fits in One DNS Name?

A single DNS label is capped at 63 characters and a full name at 253, with a limited character set, so Zenity’s proof of concept bled an Accounts table one record per lookup rather than in one request.

What Does Agentforce Print When It Blocks a Link?

Salesforce’s Trusted URLs control replaces an unapproved URL in an agent response with the token URL_Redacted, and it can show an error in the plan canvas so an admin can decide whether to allowlist that domain.

How Fast Can You Add Slack Writing to Agentforce?

Several Slack-facing subagents ship ready to use, and Zenity Labs noted that Slack Knowledge can be added with exactly 2 clicks, including its atomic actions such as thread replies.