Agentforce Zero-Click Data Exfiltration Vulnerability Exposes Enterprise Risks

Salesforce's Agentforce was vulnerable to zero-click data exfiltration due to three flaws in its design. The vulnerabilities, dubbed 'SalesBleed', allowed an attacker to extract sensitive information from the system without any user interaction or privilege escalation.

The issues arose because Agentforce allows external data ingestion through a public Web-to-Lead form, internal tool access with read permissions for Leads and Accounts tables, and output rendering of external image sources without sanitization. An attacker could inject malicious code into the Web-to-Lead form, which would then be executed by the agent when it rendered an image tag.

The data exfiltration occurred during DNS resolution, as the agent attempted to load the image from a hostname containing stolen data. This method allowed attackers to bleed entire tables of information without triggering any HTTP requests or egress controls.

Salesforce took 77 days to remediate the issue, replacing regex-based Trusted URL filtering with spec-conformant URL parsing and introducing attribution and confirmation requirements for agent actions. However, the incident highlights the risks associated with deploying agents in production environments before proper security measures are put in place.