The Web Form That Could Read Your Salesforce Data

A Lead Form Anyone Can Fill Out

Zenity Labs found three flaws in Salesforce Agentforce that let a single, unauthenticated lead submission hijack a company's AI agent and pull sensitive data out of its CRM without an employee clicking anything. The entry point was Web-to-Lead, the standard form Salesforce customers embed on their own public websites to capture new sales leads. An attacker filled out that form with hidden instructions buried in a field meant for a name or a comment, and the lead sat in the system doing nothing until an employee later asked Agentforce a routine question, such as checking recent leads.

At that point the agent read the poisoned lead as part of its normal job and carried out the hidden instructions instead of the employee's actual request. Michael Bargury, co-founder and chief technology officer at Zenity, said the flaws were not one clever workaround. "This isn't one clever bypass or a single misconfiguration," he said. "We found multiple ways to break through the security boundary designed to stop Agentforce from sending enterprise data to unapproved destinations."

An Old Trick Hiding Inside a New Interface

The way the stolen data actually left the building was not new. Salesforce's Trusted URLs system is supposed to stop Agentforce from showing images or links from sources it does not recognize, but Zenity found two gaps in how it checked a web address. The filter only recognized a fixed list of domain endings and missed newer ones such as .fun, and it disagreed with the browser about where a web address actually ends, so a string containing curly braces or square brackets could slip through as unrecognized text while still working as a live image link.

Once that gap was open, the exfiltration itself ran on DNS, one of the oldest data-smuggling techniques in security, dating back decades before AI agents existed. The agent would output an image tag pointing at an address that encoded stolen data inside its own subdomain, such as a company name and a record ID, and the moment a chat window or a Slack link preview tried to load that image, the lookup carried the data to a server the attacker controlled before any actual web request even finished loading.

Eleven Weeks, No CVE

Zenity reported the flaws to Salesforce on June 1, 2026, and the two sides moved through disclosure quickly by security industry standards. Salesforce confirmed the report the next day, held a technical call with Zenity on June 16, and committed engineering resources on June 17. Salesforce verified its fixes complete on August 18 and Zenity confirmed the Trusted URLs bypass was closed on August 19, eleven weeks after the first report. No CVE identifier was ever assigned, because Salesforce treats Agentforce as a hosted service it patches directly rather than software a customer installs and tracks with its own version number.

The Three Ingredients Are Not Unique to Salesforce

Zenity's own writeup does not frame this as a Salesforce problem. The firm says any AI agent that reads records submitted by external, untrusted sources, renders links, images or other rich content back to a user, and holds tool access to sensitive backend data has, in its words, "the same three ingredients sitting in the same place." Agentforce happened to have all three at once: a public form anyone can submit to, a chat surface that renders images automatically, and standard configuration access to the Accounts table.

That framing matters more than the specific patch. A malicious lead does not need to be acted on right away either. It can sit unnoticed in a public-facing table indefinitely, a standing foothold that only activates the moment an employee happens to ask the agent about it, which means the same three ingredients could just as easily show up in a support ticket system, a job application form, or any other public intake point feeding an AI agent with real access.

What This Means If You Run an AI Agent

The real question for any company is which of its AI agents a stranger can reach without logging in, and what that agent can touch once it does. Fixing SalesBleed took closing gaps in a URL filter, not retraining a model or making the AI more careful, because the agent was never confused; it followed instructions exactly as it was built to.

For any company running an agent with real tool access, checking the intake side matters as much as checking the model. Every public form, support ticket, and uploaded document that can reach an agent connected to a CRM, a chat tool, or an internal database is a place where the same three-ingredient pattern can show up, and treating that as an input-sanitization problem, not a model-alignment one, is what actually closes it.

Servola Journal

We do this for everyone trying to keep up with what technology is doing to our lives. The people who build it, and the people it happens to. The Servola Journal exists so that what we learn belongs to all of them.

Nobody pays us for this. No ads, no paywall, free to everyone. We just believe that understanding what's happening to all of us shouldn't depend on who can afford to pay for it.

If it gave you something today, tell us to keep going. Follow us, leave a like, or write a positive comment. We read every one, and they are what keeps us going.

Read next: Snap's Enterprise Glasses Answer to Four Vendors  |  Salesforce Backs the $5B Rival to Its Own AI Tools