> TritonInfoSec News
Home / Sep 26, 2026 / Story
0
#7 SecurityWeek general September 25, 2026 at 09:27 UTC

‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration

By Ionut Arghire

AI Summary

Researchers disclosed 'SalesBleed,' three vulnerabilities in Salesforce Agentforce that enabled zero-click data exfiltration by hijacking trusted AI agents to steal data and conduct phishing attacks via Slack. The attack chain abused prompt injection through external web content to smuggle malicious instructions across app boundaries into trusted internal communications channels. Organizations deploying Salesforce Agentforce or similar agentic AI platforms should audit agent permissions and input sanitization controls immediately.

Read full article → https://www.securityweek.com/salesbleed-flaws-in-s…

Relevance score: 78.0/100

# More from September 26

  1. 1
    U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions Krebs on Security
  2. 2
    Kiteworks urges 6-hour server shutdown over potential zero-day attacks BleepingComputer
  3. 3
    Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild The Hacker News
  4. 4
    Hackers steal $351.6 million in Bitget crypto exchange hack BleepingComputer
  5. 5
    WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV The Hacker News
  6. 6
    ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw BleepingComputer
  7. 8
    Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions The Hacker News
  8. 9
    Phone-hacking company that won U.S. security agency contracts hid Russian ownership, DOJ alleges CyberScoop
  9. 10
    OpenAI agent breached Australian government health website, Albanese says The Record