AGENTFORCE-35.1: SalesBleed: untrusted ingress + sensitive read + egress (lethal trifecta)
🔴 High · Data Exfiltration
One agent or subagent (1) reads records anyone on the internet can write (Lead via Web-to-Lead, Case via Web-to-Case / Email-to-Case, messaging transcripts, objects a guest site profile can create, or objects Experience Cloud external users (Customer / Partner Community, External Apps, portal licenses) can create or edit), (2) can read sensitive CRM data (Account, Contact, Opportunity, Contract, Order, User, objects with Confidential / Restricted fields, or any object through the standard Query Records action), and (3) has a way to send data out: an outbound action (Slack post / reply / DM, email, SMS, notifications, Apex / Flow callouts, External Service operations), instructions or a template that emit links, images or HTML / markdown (rendered or unfurled by chat and Slack surfaces), or an over-broad CSP Trusted Site. A prompt injection planted in a web-form field then reads the sensitive data and leaks it (SalesBleed). Reads come from Apex SOQL FROM / SOSL RETURNING, Flow Get Records, prompt-template SOBJECT inputs and the standard Query Records family. The three legs are checked per subagent first, then across the whole agent; one finding per agent names every subagent that holds all three legs, and retrieved planner versions (Agent_v3, Agent_v4 ...) fold into the newest one. Only reads that return text an outsider can write count as untrusted input: a read-back of CaseNumber or an Id / Email dedupe does not. Severity policy: high; critical when the output leg is an outbound or Slack write action that runs without user confirmation.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-35.1 |
| Severity | High |
| Category | Data Exfiltration |
| Compliance | HIPAA, PCI_DSS, EU_AI_ACT_HIGH_RISK |
| Tags | salesbleed, lethal-trifecta |
| Aliases | salesbleed-trifecta |
Remediation
Split the agent so the subagent that reads Lead / Case content cannot also read sensitive objects or send messages; require user confirmation on every outbound action; do not ask the model to render links, images or HTML; and restrict CSP Trusted Sites to exact hosts you own.
References
- Zenity Labs, "SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce" (Sep 24, 2026)
- Zenity Labs, "SalesBleed: Hijacking Agentforce in Slack for Anonymous Phishing Attacks" (Sep 24, 2026)