Indirect prompt injection: a public web form could make a CRM agent leak data

What happened

Indirect prompt injection happens when an AI system takes instructions from outside content it reads, rather than from its user. OWASP’s Gen AI Security Project describes it as occurring “when an LLM accepts input from external sources, such as websites or files.”

On September 24, 2026, Zenity Labs published research showing the pattern in a sales CRM. According to Zenity, an attacker could submit a lead through a public Salesforce Web-to-Lead form with a hidden prompt injection in one of the fields. When an employee later asked their Agentforce agent something routine, such as to help with the newest lead, the agent read the planted instructions. Zenity says those instructions made the agent query the Accounts table and put values such as company names and deal sizes into a web address. The chat interface then tried to load that address as an image, which caused a DNS lookup that carried the data to a server the researchers controlled. Zenity says the attacker never had to log in and the victim never had to click anything, and that it worked by getting past a redaction layer meant to strip untrusted web addresses from agent responses.

Zenity says the agent could reach both tables because the same default subagent holds read access to leads and accounts, so “the injection didn’t need to escalate privileges.” It also notes that a planted lead stays in the system and could fire again each time someone reviews it.

According to Zenity’s timeline, it reported the issue to Salesforce on June 1, 2026. Salesforce confirmed its fixes on August 18, and Zenity confirmed the fix for the reported bypass on August 19. Zenity says the full attack chain described in its post has been patched. It also says the issue isn’t unique to one vendor: any agent that reads records from outside sources, renders links or images, and has access to sensitive data has “the same three ingredients sitting in the same place.”

Why it matters to leaders (our analysis)

Web forms, inboxes, and ticket queues are built to accept text from anyone. Once an AI agent reads them, that text can become instructions. The fix in this case closed one specific bypass. The broader exposure depends on how agents are set up: what outside content they read, what else they can access, and whether their output can reach the internet on its own.

This is a configuration and governance question as much as a technical one. Agents that ship inside business software often come with broad default access. Leaders should ask which agents read outside content, narrow what those agents can reach, and treat any automatic outbound request from agent output as a possible data channel.