Zenity researchers showed how an attacker could plant malicious instructions in a public Salesforce Web-to-Lead form. When an employee asked Agentforce to review new leads, the agent followed those instructions and used its Query Records tool to read account data, including company names and deal sizes. No privilege escalation was needed—the agent already had access.
After bypassing Salesforce’s Trusted URLs filter, the payload caused the agent to put the data into an attacker-controlled hostname inside an image URL. Rendering the image triggered a DNS lookup, leaking the data even if the subsequent HTTP request was blocked.
No malicious link click was needed, but an employee still had to ask the agent to review the poisoned lead. Salesforce has patched the reported attack chain.
https://labs.zenity.io/post/salesbleed-0-click-data-exfiltration-on-agentforce
Source: r/SalesforceDeveloper · by /u/No-View3333