Hijacked by injectionPI-0075
In a researcher demo, a planted web lead hijacked Salesforce Agentforce into leaking account data through DNS
Zenity Labs reported on Sept. 24, 2026, that instructions hidden in a lead submitted through a public Salesforce Web-to-Lead form could hijack Agentforce when an employee later asked the agent about recent leads. Following the planted instructions, the agent used its Query Records tool to read the Accounts table, which the default General CRM subagent can access, and wrote values such as company names and deal sizes into the subdomain of an attacker-controlled URL. The researchers got that URL past Salesforce's Trusted URLs redaction using an unrecognized top-level domain and curly braces. Image rendering in the chat surface, or Slack link previews, then sent the data out through a DNS lookup with no click. Zenity reported the flaw on June 1, 2026, and Salesforce confirmed fixes on Aug. 18, 2026.
- Harm
- Harm: No harm reportedAdds nothing to the index.
- Control
- Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Near miss. Harm was plausible but prevented. It is rated only on what actually happened.
Sources
How we know
1 source · single source. Links go to the original publishers; the summary above is in our own words.
- researchSalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on AgentforceZenity Labs · Sept. 24, 2026labs.zenity.io/post/salesbleed-0-click-data-exfiltration-on-agentforce
Why this rating
No harm reported; control failure level 2
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm reportedResearcher demonstration. No victims or real-world exploitation reported.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Instruction violationThe agent followed injected instructions and used read access its subagent already held. No permission boundary was crossed. The redaction bypass was the researchers' crafted URL, not the agent's own initiative.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
This was a controlled researcher demonstration. The source reports no real-world exploitation or customer data loss, so the impact is not reported. Control level 2 records injected instructions obeyed within the permissions the default General CRM subagent already held. The output-redaction bypass was crafted by the researchers.
What happened
The record in full
Timeline
- Zenity Labs reported the flaw to Salesforce
- Salesforce confirmed the reports
- Salesforce fully confirmed fixes
- Zenity Labs confirmed the fix for the reported bypass
- Zenity Labs published the SalesBleed research
Effect on the index
It does not count toward the Sept. 28 reading
The reading for the week to Sept. 28, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 18 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | 2 Minor | 2 Minor |
| Harms at that level, nposition in the band | 2 | 2 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | — (none breached) |
| Readingrounded down | 25 Minor harm | 25 Minor harm |
Inside the window of 2 weekly readings
| Week to | Reading | Band |
|---|---|---|
| Sept. 28, 2026 | 25 | Minor harm |
| Oct. 5, 2026 | 25 | Minor harm |
Revisions
What we changed
2 logged. Every change to a rating is logged here, with the reason.
- v2Oct. 7, 2026
Clarified the title to say this was a researcher demonstration.
- v1Oct. 6, 2026
Added from the desk (item 272).
Cite and share
Use this record
Citation
Paperclip Index. “In a researcher demo, a planted web lead hijacked Salesforce Agentforce into leaking account data through DNS.” Record PI-0075. Reported Sept. 24, 2026; updated Oct. 7, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0075