Salesforce Agentforce Got Zero-Clicked Through Its Own Web Form – and the Attack Vector Is in Every Agent That Combines These Three Things
Enterprise web forms designed to ingest data from unknown parties are now active breach vectors. The disclosure of SalesBleed, a series of vulnerabilities in Salesforce Agentforce, confirms that a single poisoned record can trigger zero-click data exfiltration – no privilege escalation, no user click, no attachment. The entry point is the most basic form on…