Zenity Labs (Organization): news timeline & CVEs

Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk

Zenity disclosed patched zero-click prompt-injection flaws in Salesforce Agentforce that could exfiltrate CRM data.

Zenity Labs disclosed SalesBleed, a zero-click prompt-injection chain in Salesforce Agentforce. Attackers could plant hidden instructions in public Web-to-Lead forms so that, when an agent later processed the CRM record, it queried sensitive fields and exfiltrated them over DNS, bypassing Trusted URLs redaction. The attacker needed no click, stolen credentials, or login to the target org. Zenity reported the issues in June, and Salesforce fixed the redaction bypass on August 18.

Infosecurity MagazineSep 25, 13:30 UTC · 1d agoAI safety & security 6 sources

‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration

Salesforce Agentforce flaws dubbed SalesBleed let poisoned Web-to-Lead forms exfiltrate CRM data and phish via Slack.

Zenity Labs disclosed SalesBleed, three Salesforce Agentforce flaws that could hijack trusted agents through poisoned Web-to-Lead submissions. Two weaknesses in Trusted URL filtering allowed zero-click CRM data exfiltration, including via HTML image tags and Slack link previews, even when Agentforce claimed content was blocked. A third flaw let attackers post phishing messages to internal Slack channels as the agent. Zenity reported the issues on June 1, and Salesforce said all three were fixed by August 19.

SecurityWeekupdated Sep 25, 13:30 UTC · 1d agofirst Sep 25, 09:27 UTC · 1d agoAI safety & security 6 sources

Salesforce Indirect Prompt Injection Vulnerability Enables 0-click Data Exfiltration

Zenity disclosed SalesBleed, a patched Agentforce flaw enabling zero-click CRM theft via prompt injection.

Zenity Labs disclosed SalesBleed, a now-patched Salesforce Agentforce issue that could let attackers steal CRM data without logging in or any victim click. Hidden instructions in public Web-to-Lead submissions could later direct the agent, during a routine employee query, to read Account data such as company names and deal sizes. Exfiltration used an HTML image hostname that leaked values through DNS after malformed URLs bypassed Trusted URL redaction. Salesforce switched to standards-compliant URL parsing, and Zenity said it confirmed the fix in August.

Cyber Security Newsupdated Sep 25, 13:30 UTC · 1d agofirst Sep 25, 08:34 UTC · 2d agoAI safety & security 6 sources

Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection

Zenity's SalesBleed shows a zero-click Agentforce prompt injection that can leak Salesforce CRM data via DNS.

Zenity Labs disclosed SalesBleed, an indirect prompt-injection chain against Salesforce Agentforce that needs no Salesforce login or victim click. An attacker plants instructions in a public Web-to-Lead submission; when an employee later asks the agent to review leads, those instructions can drive the CRM subagent to query records such as account names and deal sizes. The proof of concept encodes the data in an attacker-controlled hostname inside an image URL so a DNS lookup exposes it, including through Slack link previews in some deployments. Salesforce said it strengthened the affected controls, changed some Slack defaults to require confirmation, and reported no evidence of exploitation in the wild.

GBHackersupdated Sep 25, 13:30 UTC · 1d agofirst Sep 25, 07:47 UTC · 2d agoAI safety & security 6 sources

Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing

Zenity Labs found Salesforce Agentforce flaws, called SalesBleed, enabling zero-click CRM theft and agent-identity phishing.

Zenity Labs disclosed SalesBleed, three now-fixed Salesforce Agentforce flaws that let poisoned Web-to-Lead records hijack agents. Indirect prompt injection could make an agent query CRM records and exfiltrate fields, such as company name and deal size, through image URLs or Slack unfurls without a user click, bypassing Trusted URL redaction. A separate Slack reply action lacked confirmation and attribution, so an insider or an injected lead could send phishing as the agent. Salesforce fixed the redaction bypass; Zenity said similar risks apply to any agent that reads external records and can call sensitive tools.

The Register · Securityupdated Sep 25, 13:30 UTC · 1d agofirst Sep 24, 19:01 UTC · 2d agoAI safety & security 6 sources

Zenity Labs

Timeline5 articles

Appears with

Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk

‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration

Salesforce Indirect Prompt Injection Vulnerability Enables 0-click Data Exfiltration

Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt Injection

Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing