AGENTFORCE-35.2: SalesBleed: over-broad CSP Trusted Site / CORS origin
🟡 Medium · Data Exfiltration
A CSP Trusted Site (cspTrustedSites) or CORS allowlist entry trusts far more than one host you own: a bare or scheme-only wildcard, a whole top-level domain (*.fun, .co.uk), a tunnel or out-of-band interaction host (oast., interactsh, ngrok, requestbin, pipedream, Burp Collaborator, webhook.site) or a shared user-content host (raw.githubusercontent.com, *.vercel.app, *.s3.amazonaws.com ...). An agent or page that renders an attacker-supplied image URL or makes a fetch then carries data to the attacker (img-src / connect-src are the usual exfiltration directives). Severity policy: medium; high when the project also has an AGENTFORCE-35.1 untrusted-ingress trifecta and the entry covers img-src or connect-src (or all directives).
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-35.2 |
| Severity | Medium |
| Category | Data Exfiltration |
| Compliance | HIPAA, PCI_DSS, EU_AI_ACT_HIGH_RISK |
| Tags | salesbleed |
| Aliases | salesbleed-csp |
Remediation
List the exact host you own (https://cdn.example.com) instead of a wildcard, remove tunnel / testing hosts, and limit the site to the directives it needs (avoid img-src / connect-src for broad origins).
References
- Zenity Labs, "SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce" (Sep 24, 2026)
- Zenity Labs, "SalesBleed: Hijacking Agentforce in Slack for Anonymous Phishing Attacks" (Sep 24, 2026)