SalesBleed: a poisoned lead form, zero clicks, and Agentforce phishing your team under its own Slack identity

Someone fills out your public contact form. Nothing happens. Three days later an employee asks the company agent "what leads came in this week," and the agent reads the injection, queries the CRM, and ships Account data out through an image request.

Zenity Labs disclosed three Agentforce flaws on September 24. Two are zero-click exfiltration paths. The first bypasses Salesforce's Trusted URLs control and leaks Accounts data through image loads and DNS requests. The second does the same through Slack link unfurling, where the preview fetch is the egress. The third is the nastier one: the attacker gets the agent to post messages through its own "Reply to Slack Thread" action, with no approval step and no attribution back to the attacker. Your team sees a message from the trusted company bot.

Disclosure timeline: Zenity notified Salesforce June 1. Trusted URLs was confirmed fixed August 19. All three were closed September 21. That's roughly four months for a zero-click data exfiltration path in an enterprise agent product, which is neither scandalous nor reassuring. SecurityWeek, The Register and Infosecurity Magazine all covered it.

The mechanic generalizes past Salesforce, and this is the part builders should internalize. The injection is stored, not delivered. It sits dormant in a row of a database until some future prompt causes an agent to read that row. There's no click, no email, no user to blame for falling for something. Any public form that writes to a table an agent later reads is an injection entry point. That includes support tickets, contact forms, webhook payloads from partners, review submissions, and comment fields.

And the exfiltration channel in both zero-click variants is URL rendering. Markdown image tags, link previews, unfurls, iframe embeds. The agent doesn't need network access to leak; it needs a client that will fetch a URL the agent chose. That's most clients.

Two concrete changes. First, tag every row an agent reads with its provenance, and put untrusted-origin content behind an explicit boundary in the prompt rather than interpolating it inline. Second, strip or proxy outbound URLs in anything an agent renders. Not "validate against an allowlist of domains," because the Trusted URLs bypass is precisely a domain allowlist being bypassed. Proxy it, log it, and make the agent's rendering layer incapable of making an arbitrary outbound request.

The Agentforce bugs and the OpenAI DNS tunnel are the same failure at different scales. Egress is whatever channel exists, not whatever channel you enumerated.