Zenity Labs published two SalesBleed write-ups on 24 September 2026 about Salesforce Agentforce. In the first, an indirect prompt injection entered through a public Web-to-Lead form and led to 0-click data exfiltration; Zenity says it bypassed Salesforce's Trusted URLs mechanism, a redaction layer built to strip untrusted URLs out of agent responses, by combining two edge cases in how URLs are identified. In the second, Zenity describes hijacking Agentforce in Slack for anonymous phishing attacks through identity impersonation.

Zenity reported the findings to Salesforce on 1 June 2026. It confirmed Salesforce's fix for the reported Trusted URLs bypass on 19 August, confirmed on 20 August that the Reply to a Slack Thread action now included correct attribution to the invoking user, and says all fixes were confirmed and tested on 21 September 2026. (source: Zenity Labs)

Correction (31 Oct 2026): replaced SecurityWeek, which this desk cannot read, and a link to Cyber Security News's home page with Zenity Labs' own write-ups, removed details that only SecurityWeek gave, and moved the card date from 25 to 24 September 2026, the date of Zenity's posts. (source: Zenity Labs)