Security researchers at Zenity Labs have disclosed a set of zero-click vulnerabilities in Salesforce Agentforce that allowed attackers to silently exfiltrate sensitive data related to customer relationship management (CRM) without any interaction from the victim and without the attacker ever authenticating into the target’s Salesforce environment.
