SalesBleed: a public web form to zero-click CRM exfiltration

What Zenity Labs reported about Salesforce Agentforce, why the pattern reaches apps you build, and seven checks you can run on your own.

Timothy Lindblom

Founder, Newly

October 24, 2026|8 min read

Published October 24, 2026Last updated October 24, 2026

SalesBleed was a set of flaws in Salesforce Agentforce, published by Zenity Labs on September 24, 2026 after Salesforce fixed them. Text hidden in a public Web-to-Lead form could steer an AI agent into sending CRM data out through an image address. Any app where an AI reads text that strangers can submit has the same shape.

What was SalesBleed?

Zenity Labs researchers described a zero-click data theft path in Agentforce. Zero-click means the employee did nothing unusual: they asked the agent about their leads, as they normally would. Facts below come from the Zenity write-up and from SecurityWeek, checked on October 24, 2026.

Fact	What the sources say
Product	Salesforce Agentforce
Found by	Zenity Labs
Reported to Salesforce	June 1, 2026 (SecurityWeek)
Fixed	All three issues addressed by August 19, 2026
Published	September 24 (Zenity) and September 25, 2026 (SecurityWeek)
Entry point	A public Web-to-Lead form, open to anyone by design
Data in reach	CRM records the agent's query tool could read, such as account names, deal sizes and contact details
CVE	None named in either source
Vendor statement	No evidence at that time that it was exploited against any customer

Two things this page does not say

It does not say your CRM was affected, and it does not say anyone was harmed. Salesforce fixed the issues before publication. The page uses the case to show a pattern you can look for in your own app.

How did a public web form reach private CRM data?

The chain has four links, and none of them needs a login until the last.

A stranger submits a lead through a form that anyone can reach. The text is stored as an ordinary record.
Later, an employee asks the agent about their leads. The agent reads the stored text, including the part written by the stranger, and treats it as instructions.
The agent has a tool that reads other CRM tables. Zenity reported it could reach account data the lead form never touched.
The agent writes that data into an address inside an image tag or a Slack message preview. When the page or preview loads, a request carrying the data goes to a server the attacker controls.

Salesforce had a filter for this, called Trusted URLs. According to SecurityWeek, it did not recognise some top-level domains, and certain character sequences could tamper with how it parsed an address, so some addresses slipped past. A third issue in the Agentforce and Slack integration let an agent be used to send phishing messages. Salesforce told SecurityWeek it strengthened Trusted URLs and changed a default Slack setting so users confirm before agents send messages.

This is indirect prompt injection. OWASP defines it as the case where an LLM accepts input from external sources such as websites or files. MITRE added it to ATT&CK as T1698 in version 20 on October 13, 2026, with AI-enabled exfiltration listed as T1700.

Does this apply to an app I built with AI?

If your app has an AI feature that reads text other people wrote, yes, the same four links can exist. Newly builds a real iPhone and Android app with React Native and Expo, and the code can be downloaded or connected to your own repository, so each layer below is yours to check. The table maps the Agentforce chain onto an app.

Link in the chain	In an app you built	What to look for
Public input	Contact form, review box, support message, profile bio, file upload, inbound email	Does any AI feature read what it stores?
Agent access	Database queries and tools the AI can call	Can it read more than the signed-in person can?
Output channel	Markdown or HTML shown in chat, email drafts, chat previews	Can it load an image or link from any address?
Send actions	Tools that email, post or call another service	Does a person confirm before it sends?

What should I check in my own app?

Seven checks, in the order the data travels. For a wider pass over keys, database rules and routes, use the 15-minute check for AI-built apps, and for the chat feature itself the chatbot self-test.

1. List every public input that an AI later reads

Search your project for each place that saves text from people who are not you, then find where the AI feature reads from the same table or inbox. Each pair is an entry point. A list on paper is enough.

2. Read the AI feature's tool list

Find where tools or functions are given to the model. Mark every one that returns data from a table beyond the current user's own rows. Those are the tools an injected instruction could use.

3. Check the key the AI's backend uses

If the AI runs queries with a database admin key, row rules do not apply to it. Supabase documents that the service role key bypasses row level security and belongs on a server only. Let the AI query as the signed-in user so the same rules that protect the app also limit the model. In Expo, EXPO_PUBLIC_ variables are readable in the compiled app, so no admin or provider key goes there.

4. Find how the AI's output is rendered

Look for the component that shows AI replies. If it renders Markdown or HTML, an image address in the reply makes the device fetch that address. An advisory for Eclipse Theia (CVE-2026-22551) describes the same class: AI chat rendered image tags and sent requests to arbitrary external addresses. It was fixed in version 1.71.0. The simple rule is to drop image and link rendering from AI output, or to allow only hosts you list.

5. Add an image allowlist on web surfaces

If the app has a web view or a website with the chat, set the img-src directive of your content security policy to 'self' plus the hosts you use. An image from any other host is then blocked. This does not apply to a native screen, so the rendering rule in check 4 is the one that covers an iPhone or Android view.

6. Require a person to confirm sends

Any tool that sends email, posts a message or calls an outside service should show the draft and wait. OWASP lists human approval for high-risk actions among its main defenses. Salesforce moved in this direction as well for Slack messages.

7. Limit and log

Cap messages per user and keep a log of what the AI read and sent. AI inside a Newly app uses credits, so a public input that triggers the AI also lets a stranger spend them. The log is how you answer later whether anything left.

What actually reduces the risk?

No filter on words removes indirect prompt injection. The CISA guide to agentic AI, published May 1, 2026 with international partners, tells organisations to avoid broad or unrestricted access, especially to sensitive data, and to begin with low-risk use cases. The OWASP GenAI LLM Top 10 for 2026 carries the same theme in its list. The Salesforce case fits: the filter was a patch on the last link, and the damage depended on the access of the second.

Narrow the access first. It limits what any injection can reach.
Control the output second. It closes a common way for data to leave.
Keep a person in the loop for sends. It stops the silent version.

If a key might have been exposed along the way, rotate it using the rotation guide for app teams. For the wider October 2026 picture, see the overview for app builders, and the security hub lists the rest.

Where do you stand?

Everything starts as unknown, because an unchecked item is unknown. Move an item to confirmed only when you hold the evidence under it. A scan from outside, including ours, cannot move the first five items for you, since the AI reads stored text inside your backend.

Your AI-reads-outsider-text check

Detected: You found the problem.
Unknown: Not checked yet, or the check could not tell.
Confirmed by owner evidence: You checked and kept the proof.

1. I know every public form, comment box, upload and inbound email that stores text an AI feature may later read.
Evidence: a written list of each input and which feature reads it.
2. The AI feature can read only what the signed-in person could already read, and it has no tool that returns other people's records.
Evidence: the tool list, and a test with a second account showing the other account's data does not come back.
3. Rendered AI output cannot load an image or link from an address I did not list.
Evidence: the img-src line of your content security policy, or the code that strips or allowlists image addresses.
4. Any action that sends a message, email or request needs a person to confirm it.
Evidence: the setting or screen where the confirmation happens.
5. Stored text from outsiders is passed to the model as marked data, apart from my own instructions.
Evidence: the prompt template showing the separation.
6. Messages are limited per user, and I can see what the AI read and sent for any past request.
Evidence: the rate limit setting and one log entry for a real request.

0 detected6 unknown0 confirmed by owner evidence

Your answers stay in this browser tab. Nothing is saved or sent.

Frequently asked questions

Was SalesBleed used against real companies?

Salesforce said it had no evidence at that time that the reported issue was exploited against any customer (SecurityWeek, September 25, 2026). That is the vendor's statement, and nobody outside can confirm it. Treat it as a dated claim that proves nothing in either direction.

Does this affect me if I do not use Salesforce?

Possibly, if your app has three parts: a public input that stores text, an AI that later reads that text with access to private data, and an output channel that can send data to an address chosen by the text. Any app with those parts can have the same shape, whatever CRM or backend it uses.

Can a better system prompt stop this?

Not reliably. OWASP describes indirect prompt injection as a risk that wording alone does not remove, and lists least privilege, human approval for high-risk actions and separating external content as the main defenses. Limit what the agent can reach and what it can send out.

What is the single most useful change to make?

Give the AI feature the access of the person using it and nothing more, then stop rendered output from loading images from addresses you did not list. The first limits what can be read. The second closes one common way for it to leave.

I use an AI feature inside a Newly app. What applies to me?

Newly builds a real React Native and Expo app and you can download the code or connect your own repository, so the checks on this page apply to the code you own. AI inside your app uses credits, so a public input that triggers the AI also lets a stranger spend them. Set limits per user.

Does a free scan of my website cover this?

Only part of it. The free scan on red.run.cloud matches the stack your site serves to known vulnerabilities and checks exposed files and headers, including the content security policy. It cannot see how your AI reads stored text, so those items stay unknown until you check them yourself.

Sources

SalesBleed: 0-click data exfiltration on Agentforce, Zenity Labs, checked October 24, 2026
SalesBleed flaws in Salesforce Agentforce enabled zero-click data exfiltration, SecurityWeek, September 25, 2026, checked October 24, 2026
LLM01 Prompt Injection, OWASP GenAI Security Project, checked October 24, 2026
OWASP GenAI LLM Top 10 2026, OWASP GenAI Security Project, checked October 24, 2026
ATT&CK v20, October 2026 update, MITRE, October 13, 2026, checked October 24, 2026
GHSA-qwjm-9c66-w4q4 (CVE-2026-22551), Eclipse Theia, GitHub Advisory Database, checked October 24, 2026
Content-Security-Policy: img-src, MDN Web Docs, checked October 24, 2026
Guide to the secure adoption of agentic AI, CISA and international partners, May 1, 2026, checked October 24, 2026
Environment variables in Expo, Expo docs, checked October 24, 2026
Row Level Security, Supabase docs, checked October 24, 2026