The Least Trusted Author Sets the AI Agent's Privilege

Summary: Zenity Labs disclosed three vulnerabilities in Salesforce Agentforce on September 24, 2026, collectively named SalesBleed, in which instructions planted in a public Web-to-Lead form lay dormant until an employee asked an agent to help with recent leads, after which the agent queried account data and rendered an image tag pointing at attacker-controlled infrastructure. Two of the three findings bypassed Salesforce's Trusted URLs control to enable zero-click data exfiltration, and the third, in Agentforce's Slack integration, let the Reply to a Slack Thread action send without user confirmation or visible attribution to the invoking user.
Key Takeaway: Two research teams a year apart, Zenity with SalesBleed and Noma Security with ForcedLeak in September 2025, reached sensitive CRM data through the same public form, and the Slack finding meant recipients of phishing replies saw only the agent's identity with nothing pointing to the person whose request triggered it, leaving incident responders unable to scope an agent-mediated exfiltration.

Read the original at The Hacker News ↗