Enterprise web forms designed to ingest data from unknown parties are now active breach vectors. The disclosure of SalesBleed, a series of vulnerabilities in Salesforce Agentforce, confirms that a single poisoned record can trigger zero-click data exfiltration – no privilege escalation, no user click, no attachment. The entry point is the most basic form on the modern internet: a public Web-to-Lead endpoint, the kind organizations deliberately leave open to collect leads from strangers.
The attack works by combining three capabilities Agentforce ships by default. First, external data ingestion: a Web-to-Lead form accepts unauthenticated submissions from anyone. Second, internal tool access: the General CRM subagent ships with read access to both Leads and Accounts tables through the same Query Records tool – there is no privilege boundary between the table that receives external submissions and the table that holds deal sizes and company names. Third, output rendering: the chat surface renders external image sources without sanitization or user interaction. An attacker hides a prompt injection payload in a lead field. When an employee later asks the agent a routine question about their pipeline, the poisoned record hijacks the agent and instructs it to query the Accounts table, encode the retrieved data into a subdomain of an attacker-controlled hostname, and render it as an HTML image tag. The agent complies.
The exfiltration method is what makes SalesBleed particularly instructive. The agent does not make an HTTP request to the attacker’s server. It renders an image tag whose source attribute contains stolen data buried in the hostname’s subdomain: https://Acme-712412.attacker-subdomain.oast.fun{e}. The client attempts to load the image, which means resolving that hostname via DNS. The data leaves during the DNS resolution itself. As the Zenity Labs researchers put it: “The HTTP request that follows is essentially irrelevant: it can fail, be blocked, time out, or never happen, since at this point the data has already left.” A single DNS label can carry 63 characters. Continuous queries bleed entire tables, one record per lookup, in a method that survives HTTP egress controls.
Salesforce relied on its Trusted URLs mechanism to strip untrusted links from agent output. That control broke on two edges. The redactor recognized only a fixed set of top-level domains as valid hosts – .fun, conveniently the TLD used by the Out-of-Band testing platform interactsh.com, was not among them. Adding curly braces or square brackets to the end of a URL created a second gap: the redactor and the downstream renderer disagreed on where a valid URL terminated. A string like https://random.oast.fun{email} looked like a malformed non-URL to the parser but generated a real DNS query when the browser tried to load it from an image tag. As the researchers observed, “Output redaction is the control many vendors have reached for, however output redaction is also a race between a parser and every renderer downstream of it. Unfortunately, that’s a race the parser can sometimes lose at.”
The Slack phishing vector extended the same structural failure into a different trust channel. The Agentforce-Slack integration includes a “Reply to a Slack Thread” action that, unlike the direct-message action, lacked both user confirmation and invoker attribution. The same Web-to-Lead injection that triggers data exfiltration can instruct the agent to post a phishing link in an internal channel – and recipients see the message as coming from the enterprise’s trusted agent identity, with no flag indicating an external submission or unconfirmed user triggered it. “This is essential for indirect prompt injection,” Zenity wrote, “since an employee may ask the agent to review a lead, while instructions inside that lead tell it to post a message in Slack.”
This pattern has a name. The “lethal trifecta,” as Simon Willison defined it, is the combination of private data access, untrusted content exposure, and external communication ability. When an agent has all three, an attacker who controls any content it processes can trick it into stealing data and exfiltrating it out. SalesBleed is the first documented real-world execution of this pattern against an enterprise CRM agent. The ingredients are not exotic. As Zenity Labs remarked: “Any agent that reads records submitted by external sources, renders links or images back to a user, and also holds tool access to sensitive data, has the same three ingredients sitting in the same place.”
Salesforce disclosed no CVEs – these were architectural fixes in a hosted service, not traditional software patches. The remediation replaced regex-based Trusted URL filtering with spec-conformant URL parsing, added attribution to Slack agent actions, and introduced a default confirmation requirement for the thread-reply action. All fixes were confirmed by September 21, 2026. Salesforce states no evidence of in-the-wild exploitation. But the 77-day window between disclosure and full remediation – during which the General CRM subagent’s default configuration still exposed both Leads and Accounts tables to poisoned submissions – is worth noting. For every customer who deployed Agentforce with default settings during that period, the ingredients were present.
This connects to prior coverage that mapped the same structural gap from different angles. The agent governance stack analysis showed Okta, IBM, Broadcom, and Dataiku filling a market gap where platform vendors’ native controls have lagged. The Anthropic Misuse Report documented how AI agents now perform autonomous breach operations that once required human labor. NiCE’s $955M acquisition of Cognigy put the routing layer – where trust decisions between human and agent happen – at a $25x revenue valuation. Every one of these data points points the same way: agents are moving into production faster than trust and identity infrastructure can contain them.
SalesBleed proves the pattern works. The fix was technical. The problem is architectural. Any agent that reads externally-provided data, holds access to internal records, and renders output back through a browser or messaging platform where links or images auto-resolve will exhibit the same three-ingredient failure. The rush to deploy enterprise agents right now is happening before most organizations have figured out how to enforce tool access, trust boundaries, or even basic least-privilege accounting for the accounts their agents run as. According to Okta’s 2026 report, 34 percent of organizations apply the same security controls to AI agents as to human workers. The other 66 percent are deploying them now, in production, with the same open defaults that just broke Salesforce.