Zenity Labs finds zero-click bugs in Salesforce Agentforce

Zenity Labs reported the vulnerabilities to Salesforce in June, giving the vendor roughly two months before Salesforce fully fixed the URL redaction bypass on August 18. The public disclosure, published September 24, comes after that remediation. The SalesBleed chain relied on three elements the researchers say sit together in many agent deployments: untrusted input via Web-to-Lead forms, an agent that treats record content as instructions and can render links or images, and backend tool permissions reaching sensitive data. The researchers demonstrated the risk by exfiltrating company names and deal sizes using DNS-based techniques that evaded Salesforce's Trusted URLs controls.

For readers outside security engineering, the significance is less about Salesforce specifically and more about a class of AI agents that are given access to both external inputs and sensitive internal systems. Zenity's report describes the payload as capable of querying anything a subagent's Query Records tool can reach, which in a typical General CRM deployment includes accounts and contacts. That breadth is what turns an otherwise ordinary record processing step into a potential exfiltration path.

Whether similar exposures are found elsewhere hinges on whether other agent platforms also combine externally submitted records, rich content rendering, and broad tool permissions without adequate separation. Organizations deploying such agents may need to examine which inputs are trusted and what data their agents can reach. The body does not specify what additional steps, if any, Salesforce or Zenity have planned beyond the August 18 fix.