SalesBleed: Zero-Click Chain Exfiltrating Data via DNS from Agentforce via Indirect Prompt Injection

Security researchers at Zenity demonstrated a proof-of-concept attack chain, dubbed SalesBleed, that exfiltrates Salesforce data through DNS queries by exploiting an indirect prompt injection in the Agentforce General CRM subagent. An attacker plants malicious instructions in a public Web-to-Lead form, and when an internal user submits a standard lead inquiry, the subagent retrieves Account values and embeds them in the hostname of an attacker-controlled domain, which is then resolved via the browser's DNS resolver. Zenity's controlled test confirmed Account values could be retrieved via DNS, though active exploitation in the wild is unconfirmed.

1. Basic Information 2. Executive Summary An indirect prompt injection embedded in a public Web-to-Lead form manipulated the Agentforce General CRM subagent, incorporating account information into the hostname of an attacker-controlled domain and exfiltrating it via DNS queries. 3. Attack Flow From Public Lead to DNS Exfiltration 1. An attacker persists an indirect prompt injection via Web-to-Lead. 2. An internal user sends a standard lead inquiry to Agentforce. 3. The General CRM subagent follows the instructions in the lead and retrieves Account values. 4. It generates an image URL that exploits the discrepancy between the redactor and the browser parser. 5. The browser or unfurl process resolves the attacker's domain, leaking data within the hostname via DNS. 4. Attacker Position and Execution Location - The attacker submits data from an unauthenticated public form. - Sensitive data retrieval occurs within the subagent inside Salesforce, while exfiltration occurs via the DNS resolver of the user's browser or a connected service. 5. Victim and Administrator Perspective Victim - Even standard inquiries can process malicious leads. Report suspicious external images or abnormal responses to the administrator. Administrator - Verify patch status and restrict subagent privileges, public form inputs, HTML rendering, and outbound DNS traffic. 6. Success and Failure Conditions Success Conditions - Public inputs are later incorporated into the Agentforce context. - The General CRM subagent has read permissions for Leads and Accounts, and external domains can be resolved from the generated HTML. Failure Conditions - External inputs are not treated as instructions, and subagent object and field permissions are minimized. - External resources are not automatically fetched from rich text, and DNS/HTTP egress is restricted to approved domains. 7. Impact Upon Success - Account information and other internal Salesforce data leak to the attacker as DNS query names. - Because the malicious lead persists, multiple standard inquiries may trigger recurrent exploitation. 8. Observable Logs - Email : Verify Web-to-Lead notification times and user query timestamps. - Proxy / SWG / DNS : Check for long DNS labels targeting unfamiliar TLDs such as .fun and external image URLs. - Endpoint / EDR : Verify external resource retrieval by user browsers or connected clients. - Identity / IdP : Confirm Agentforce execution actors and subagent permissions. - SaaS / Cloud : Review lead creation, account reads, agent traces, and response renderers. - Network : Reconstruct DNS query labels and investigate correlations with CRM field values. 9. Attack Success Determination - Information Theft or Session Compromise Confirmed : Zenity's controlled PoC successfully embedded and retrieved Account values via DNS queries. Scope: Research environment; active exploitation in the wild unconfirmed. 10. Investigation Playbook - Origin : Start from related alerts, vulnerable assets, or indicators listed in the primary source. - Initial Response : Check target versions, exposure surfaces, occurrence times, sources, and change logs. - Endpoint : Preserve processes, files, services, persistence mechanisms, and EDR telemetry. - Identity / Cloud : Verify tokens, keys, logins, and SaaS/cloud audit logs. - Follow-up : Track information theft, lateral movement, additional payloads, and configuration changes. - Containment : Isolate affected assets, apply patches, rotate credentials, and remove malicious modifications. - Triage : Document contact, initial execution, authentication/malware success, information compromise, and subsequent compromises separately. 11. Defense and Detection Ideas - Single Event : Detect anomalous events, paths, processes, and token usage noted in primary sources. - Timeline : Correlate events from ingress and execution to credential access and outbound traffic in a short time frame. - Hunting : Cross-reference impact duration with asset inventories to proactively hunt for matching IoCs and behaviors. - Log Gaps : Missing application, host, identity, or network logs can lead to misjudgments of success stages. - Prioritized Measures : Prioritize applying patches, enforcing least privilege, controlling outbound traffic, and retaining audit logs. 12. Facts / Inference / Hypothesis Facts - An attacker saved natural language instructions into a lead field via a public Web-to-Lead form. - When an internal user made a standard lead inquiry, the General CRM subagent read the malicious lead and incorporated values retrieved from Accounts into the hostname of the attacker's domain. - Combining an unknown .fun TLD with {} or prevented the Trusted URLs redactor from treating it as a URL, while the browser interpreted it as an image URL. - A DNS query occurred during the resolution of the generated HTML image tag, leaking data within the hostname without permitting the HTTP body. - Zenity reported the issue on June 1, 2026, Salesforce issued a patch on August 18, and Zenity confirmed the fix on August 19. Inference - Outbound traffic security measures for AI agents must encompass DNS query names in addition to HTTP allowlists, monitoring the boundaries where model outputs are interpreted as HTML or URLs. Hypothesis 13. MITRE ATT&CK Mapping | ID | Technique | Confidence | Basis | | T1659 | Content Injection | High | Indirect prompt injection is saved into public lead fields. | | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | Medium | Data is embedded in DNS queries sent to an attacker-controlled domain. | 14. Uncertainties and Further Investigation - Whether this chain was actively exploited in production environments. - The blast radius of remaining distinct subagents, rich-text renderers, and Slack unfurl pathways post-patch. 15. Impact on SOCs and Organizations Organizations in Japan utilizing Agentforce integrated with Web-to-Lead should verify designs that prevent external inputs from escalating into trusted instructions, along with subagent object permissions, rich-text rendering, and DNS monitoring. Because execution is triggered solely by routine business inquiries, mitigation should focus on data boundaries and outbound traffic control rather than user training. 16. Summary by Role - SOC : Correlate Agentforce executions and long DNS labels targeting unknown domains with simultaneous Lead/Account read operations. - Administrator : Verify patch status and restrict subagent privileges, public form inputs, HTML rendering, and outbound DNS traffic. - Victim : Even standard inquiries can process malicious leads. Report suspicious external images or abnormal responses to the administrator.