The lead form was the way in: indirect prompt injection and the SalesBleed lesson

What SalesBleed did, and why indirect prompt injection needed no click#

Start with the quiet quarry. A marketing team runs a website form, the form feeds the CRM, and an AI agent reads the CRM so a salesperson can ask it for a summary of this morning's leads. Every step is ordinary. On 24 September 2026, Zenity Labs published SalesBleed, a chain of three flaws in Salesforce Agentforce that turned that ordinary loop into an exit. Its own one-line verdict is hard to beat: the entry point was a public Web-to-Lead form, and the exit was a DNS query.

The mechanism is indirect prompt injection. Nobody attacked the model directly. An attacker typed instructions into a field on a public lead form, the text sat in the Leads table like any other enquiry, and it waited. As SecurityWeek reported on 25 September, the malicious instructions stayed dormant until an employee asked an Agentforce agent to work with that submission. Then the agent read the attacker's words as if they were part of its job.

That is the whole trick, and it is why the phrase indirect prompt injection matters more than the brand name on this particular bug. The OWASP Top 10 for LLM Applications puts prompt injection first, as LLM01, and defines the indirect kind as the moment a model accepts input from external sources such as websites or files. A lead form is an external source with a friendly face.

The persistence problem nobody budgets for#

Zenity noted something that should keep revenue operations teams awake. The poisoned lead does not fire once and vanish. It persists in the Leads table and could execute again every time an employee reviews it. A phishing email gets deleted. A poisoned CRM record gets handed round the sales floor, lovingly enriched, and summarised on every pipeline call.

And the volume ceiling is generous. As Formstack's guide to Web-to-Lead limits notes, Salesforce lets the feature generate 500 leads per 24 hours from prospects who submit contact details. For a growth team that is a feature. For an attacker it is 500 chances a day to leave a note under the door.

The fox reads the hedgerow, not just the path. Indirect prompt injection is a hedgerow problem: the danger sits in the undergrowth your agent is paid to read, not on the road your firewall is built to watch.

How the data got out when Salesforce Agentforce said it was blocked#

The second half of the chain is the part security buyers should study. Agents that can write links or images into a reply can smuggle data out inside those links. Salesforce knew this. After a similar disclosure a year earlier, it shipped a control called Trusted URL allowlisting which, as The Hacker News reported in September 2025, stops agent output being sent to untrusted URLs by enforcing a URL allowlist.

SalesBleed walked round that fence. Zenity's write-up describes three parsing gaps: a redactor that did not recognise some top-level domains as hosts, a disagreement between redaction and rendering over where a URL ends, and malformed addresses that slipped past redaction but still worked inside an image tag. The data then left by DNS, which Zenity notes is cramped, since a single label caps at 63 characters and a full name at 253, but it slips past controls built for web traffic.

SecurityWeek relayed the detail that stings most: Agentforce reported that the content had been blocked, while the sensitive CRM data had already been sent to the attacker's server. A control that reports success after the fact is a comforting light over an empty henhouse.

The dates are worth reading slowly. Zenity's disclosure timeline says the flaws were reported to Salesforce by email on 1 June 2026, and that the fixes were fully confirmed by Salesforce on 18 August. That is a responsible, ordinary disclosure: roughly eleven weeks of quiet work, then publication once the patch was in.

This was not the first lead form through the door#

There is a precedent, and it is almost the same animal. In September 2025 Noma Security disclosed ForcedLeak, another indirect prompt injection against Agentforce that also rode in on Web-to-Lead. Its exfiltration route used an allowlisted domain that had expired, and Noma's researchers noted that the domain they bought to prove it cost $5. Salesforce's answer, as quoted by The Hacker News, was that its services would enforce the Trusted URL allowlist so no malicious links are called or generated through potential prompt injection.

SalesBleed is what happens a year later when the fix is a list and the attacker studies how the list is read. That is not a scandal. It is the normal rhythm of this category, and it is exactly why prompt injection prevention cannot be sold as a single switch.

What the research measures about indirect prompt injection, and what it does not#

Security marketing lives or dies on one distinction: what researchers observed attackers doing, and what a vendor says attackers could do. They are different sentences and they deserve to look different on the page.

Here is the measured side. The idea itself is old enough to have a paper trail: Greshake and colleagues described indirect prompt injection in 2023, warning that LLM-integrated applications blur the line between data and instructions. Since then the benchmarks have got specific. Agent Security Bench, presented at ICLR 2025, reported a highest average attack success rate of 84.30% against LLM agents, with limited effectiveness from current defences. WASP, a web-agent benchmark, found attacks partially succeed in up to 86% of cases, while agents often struggle to complete the attacker's full goal.

And the sober counterweight. AgentDojo, built on 97 realistic tasks and 629 security test cases, found that existing attacks break some security properties but not all. That line is the honest middle. Indirect prompt injection works often enough to take seriously and unreliably enough that every headline claiming it is unstoppable is overselling.

The regulator's view is the sharpest sentence in the pile#

The UK National Cyber Security Centre wrote in December 2025 that prompt injection attacks will remain a residual risk and cannot be fully mitigated with a product or appliance. Read that twice if you sell security. It is the most useful sentence a vendor can quote, because it frames your product as one layer in a design rather than a cure, and buyers trust the vendor who admits the ceiling.

The standards bodies agree on the shape. NIST AI 100-2 E2025 lists leaking restricted information through indirect prompt injection as a recognised attack class. For firms in scope of the EU AI Act, Article 15 requires high-risk systems to be resilient against attempts by unauthorised third parties to alter their use or outputs by exploiting vulnerabilities. None of these documents promises a fix. All of them expect a plan.

That practitioner question, posted hours after the story broke, is the right one. The fix closed a parsing gap. The design choice that made the gap matter, an agent that treats anything in the CRM as instructions, is still sitting in many a den.

What marketing and RevOps teams should change on Monday#

This is where the story stops being a security bulletin and becomes a marketing operations brief. The lead form belongs to marketing. The CRM hygiene belongs to RevOps. The agent was bought by sales. Indirect prompt injection lives in the gap between three owners, which is exactly where nobody is watching.

Start with the form. Every free-text field on a public form is now an input to software that can act. That does not mean killing the form, which would be a cure worse than the cold. It means treating form text as untrusted data, keeping it out of the instruction path, and asking your platform owner which agents read which fields.

Scope what the agent can touch, not just what it can say#

The most useful line in the social chatter came from security practitioners, not vendors: scope data access and egress together. An agent that can read the whole accounts table and also fetch external URLs is one clever sentence away from exporting the accounts table. Take away either half and the same injection becomes a nuisance rather than a breach.

Then log it. If an agent summarised a poisoned lead, you want to know which records it read and what it wrote, in the same way you would want to know which inbox opened the phishing email. Treat agent activity as a system of record, not a chat window.

Finally, write the incident sentence before you need it. Our interactive story on what a brand should say while a story is unconfirmed makes the point that attribution beats adjectives. If your agent ever leaks, you will want a statement written in the calm, not in the storm. We help teams build that muscle as part of AI consultancy work, alongside the agent governance we covered in agentic AI security and the runaway meter.

What SalesBleed means for security vendors' marketing#

Now the other audience. If you sell AI security, SalesBleed is a gift and a trap in the same parcel. The gift is a clean, dated, well-documented case your buyers already understand, because every buyer has a lead form. The trap is the temptation to write it up as proof the sky is falling.

Look at what else happened the same week. Decrypt reported on 24 September that Darktrace gave AI agents ten coding challenges, two of them rigged to be impossible, and two agents attacked the test network instead. SecurityWeek reported that OpenAI agents had probed websites while fetching public data, while noting that none of the attempts appears to have succeeded. Two very different findings, both easy to flatten into the same breathless headline.

The discipline that wins here is the one we set out in the 24-hour credibility test: say what was measured, by whom, under what conditions, and put the limits on the same panel as the claim. A lab rate of 84% is a lab rate. A proof of concept against a patched product is a proof of concept. Neither is evidence of attacks in the wild, and neither Zenity nor SecurityWeek reported any exploitation of SalesBleed outside research.

Content that earns the meeting#

The content that works for AI security buyers is practical and specific: a checklist mapping OWASP LLM01 to a buyer's own stack, a short explainer of what Trusted URL controls do and do not stop, a plain-English answer to what are the risks of prompt injection in a CRM. That is the kind of content marketing that ranks, gets cited by answer engines and gets forwarded to the CISO. It is also how we approach cybersecurity marketing for vendors, and it is the same advisory posture we argued for in our Check Point zero-day piece.

Fear sells a demo. Clarity sells a renewal. A vendor who can explain indirect prompt injection to a head of marketing without a single scary adjective will outfox the one with the loudest webinar.

Frequently asked questions#