Salesforce Agents Left Vulnerable to Data Breaches and Phishing Attacks

Salesforce's Agentforce platform has been a significant success for the company, but recent research has exposed security vulnerabilities in its design. A team of investigators from Zenity Labs was able to exploit two bugs that allowed them to pull sensitive account data without logging in.

The researchers discovered that these vulnerabilities could be used to hijack Agentforce agents and send phishing messages. They also found that the bugs enabled 0-click data exfiltration, which allows attackers to extract sensitive information without any action from the user.

According to researcher João Donato, 'hijacking enterprise agents via untrusted external data remains a broader risk' and 'any agent integrated into trusted workplace tools can significantly expand an attacker's reach.'