Salesforce Agentforce agentic AI attack — Sep 2026

What happened

On September 24, 2026, Zenity Labs disclosed a zero-click attack chain dubbed SalesBleed, which targeted Salesforce Agentforce. The attack exploited the way AI agents process external data, specifically through a company's "contact sales" web form. An attacker submitted malicious instructions within the form fields, which were then stored in the CRM. When a sales representative later instructed the agent to review leads, the agent processed the poisoned entry.

Following the injected instructions, the agent autonomously queried the company's Accounts database—a task permitted by its broad role-based access configuration—and exfiltrated sensitive data by embedding it into the hostname of an image URL. The subsequent DNS lookup by the browser effectively leaked the information to an attacker-controlled server. Salesforce has since patched the specific URL-parsing vulnerability that facilitated this exfiltration path.

According to Tenuo Engineering, the incident highlights a systemic issue known as "shadow delegation," where agents operate with broad, standing permissions rather than task-specific authority. Because the agent's authorization layer lacked a machine-verifiable description of the specific task (e.g., "review this single lead"), it was able to use its full, authorized access to query unauthorized database tables when prompted by the malicious input. The attack succeeded because the agent's permissions were not constrained to the immediate context of the user's request, allowing the model to act on behalf of the attacker using its own legitimate credentials. This incident demonstrates that even when authorization checks pass, the lack of granular, task-scoped authority can lead to significant data exposure if the agent is successfully manipulated via prompt injection.