SalesBleed: Zero-Click Chain Exfiltrating Data via DNS from Agentforce via Indirect Prompt Injection

wpnews.pro

An indirect prompt injection embedded in a public Web-to-Lead form manipulated the Agentforce General CRM subagent, incorporating account information into the hostname of an attacker-controlled domain and exfiltrating it via DNS queries.

#

Attack Flow

From Public Lead to DNS Exfiltration

An attacker persists an indirect prompt injection via Web-to-Lead.
An internal user sends a standard lead inquiry to Agentforce.
The General CRM subagent follows the instructions in the lead and retrieves Account values.
It generates an image URL that exploits the discrepancy between the redactor and the browser parser.
The browser or unfurl process resolves the attacker's domain, leaking data within the hostname via DNS.

#

Attacker Position and Execution Location

The attacker submits data from an unauthenticated public form.
Sensitive data retrieval occurs within the subagent inside Salesforce, while exfiltration occurs via the DNS resolver of the user's browser or a connected service.

#

Victim and Administrator Perspective

Victim

Even standard inquiries can process malicious leads. Report suspicious external images or abnormal responses to the administrator.

Administrator

Verify patch status and restrict subagent privileges, public form inputs, HTML rendering, and outbound DNS traffic.

#

Success and Failure Conditions

Success Conditions

Public inputs are later incorporated into the Agentforce context.
The General CRM subagent has read permissions for Leads and Accounts, and external domains can be resolved from the generated HTML.

Failure Conditions

External inputs are not treated as instructions, and subagent object and field permissions are minimized.
External resources are not automatically fetched from rich text, and DNS/HTTP egress is restricted to approved domains.

#

Impact Upon Success

Account information and other internal Salesforce data leak to the attacker as DNS query names.
Because the malicious lead persists, multiple standard inquiries may trigger recurrent exploitation.

#

Observable Logs

Email : Verify Web-to-Lead notification times and user query timestamps. #

Proxy / SWG / DNS : Check for long DNS labels targeting unfamiliar TLDs such as`.fun` and external image URLs. #

Endpoint / EDR : Verify external resource retrieval by user browsers or connected clients. #

Identity / IdP : Confirm Agentforce execution actors and subagent permissions. #

SaaS / Cloud : Review lead creation, account reads, agent traces, and response renderers. #

Network : Reconstruct DNS query labels and investigate correlations with CRM field values.

#

Attack Success Determination

Information Theft or Session Compromise Confirmed : Zenity's controlled PoC successfully embedded and retrieved Account values via DNS queries. (Scope: Research environment; active exploitation in the wild unconfirmed.)

#

Investigation Playbook

Initial Response : Check target versions, exposure surfaces, occurrence times, sources, and change logs. #

Endpoint : Preserve processes, files, services, persistence mechanisms, and EDR telemetry. #

Identity / Cloud : Verify tokens, keys, logins, and SaaS/cloud audit logs. #

Follow-up : Track information theft, lateral movement, additional payloads, and configuration changes. #

Containment : Isolate affected assets, apply patches, rotate credentials, and remove malicious modifications. #

Triage : Document contact, initial execution, authentication/malware success, information compromise, and subsequent compromises separately.

#

Defense and Detection Ideas

Single Event : Detect anomalous events, paths, processes, and token usage noted in primary sources. #

Timeline : Correlate events from ingress and execution to credential access and outbound traffic in a short time frame. #

Hunting : Cross-reference impact duration with asset inventories to proactively hunt for matching IoCs and behaviors. #

Log Gaps : Missing application, host, identity, or network logs can lead to misjudgments of success stages. #

Prioritized Measures : Prioritize applying patches, enforcing least privilege, controlling outbound traffic, and retaining audit logs.

#

Facts / Inference / Hypothesis

Facts

An attacker saved natural language instructions into a lead field via a public Web-to-Lead form.
When an internal user made a standard lead inquiry, the General CRM subagent read the malicious lead and incorporated values retrieved from Accounts into the hostname of the attacker's domain.
Combining an unknown .fun TLD with{} or[] prevented the Trusted URLs redactor from treating it as a URL, while the browser interpreted it as an image URL.
A DNS query occurred during the resolution of the generated HTML image tag, leaking data within the hostname without permitting the HTTP body.
Zenity reported the issue on June 1, 2026, Salesforce issued a patch on August 18, and Zenity confirmed the fix on August 19.

Inference

Outbound traffic security measures for AI agents must encompass DNS query names in addition to HTTP allowlists, monitoring the boundaries where model outputs are interpreted as HTML or URLs.

Hypothesis

#

MITRE ATT&CK Mapping

#

Uncertainties and Further Investigation

Whether this chain was actively exploited in production environments.
The blast radius of remaining distinct subagents, rich-text renderers, and Slack unfurl pathways post-patch.

#

Impact on SOCs and Organizations

Organizations in Japan utilizing Agentforce integrated with Web-to-Lead should verify designs that prevent external inputs from escalating into trusted instructions, along with subagent object permissions, rich-text rendering, and DNS monitoring. Because execution is triggered solely by routine business inquiries, mitigation should focus on data boundaries and outbound traffic control rather than user training.

#

Summary by Role

SOC : Correlate Agentforce executions and long DNS labels targeting unknown domains with simultaneous Lead/Account read operations. #

Administrator : Verify patch status and restrict subagent privileges, public form inputs, HTML rendering, and outbound DNS traffic. #

Victim : Even standard inquiries can process malicious leads. Report suspicious external images or abnormal responses to the administrator.

source & further reading

dev.to — original article Your AI Vendor Just Became a Supply-Chain Risk Building FoxyInvoice — Chapter 11: Reach — SEO, AI crawlers, and being the machine-readable answer Decentralized Medical AI: How to Build HIPAA-Ready Analytics with Differential Privacy