SalesBleed is a good example of why AI agents need task-scoped permissions, not just roles

SalesBleed was a zero-click attack chain disclosed on September 24, 2026, that exploited Salesforce Agentforce's authorization model. An attacker submitted a poisoned lead via a contact sales form, which was processed by the AI agent with broad role-based permissions. The agent queried sensitive CRM data and exfiltrated it by encoding information in DNS lookups to an attacker-controlled server. Although Salesforce patched the URL-parsing vulnerability that enabled this exfiltration, the broader issue remains: the agent's authorization layer granted access based on roles without verifiable task context, a condition called shadow delegation. This allowed the agent to act with all permissions of its role regardless of the specific task, enabling attackers to misuse the agent's privileges without stealing credentials. The incident illustrates the limitations of traditional role-based access control (RBAC) for AI agents, which dynamically choose actions at runtime unlike predictable human users. The recommended security model is task-scoped permissions—authority granted narrowly for each specific task—akin to a valet key that limits what an agent can do per request. This approach reduces risk by attaching authority to tasks rather than identities alone. The vendor Salesforce fixed the exploited bugs, but the underlying authorization design gap persists in many AI agent systems.

The attack enabled unauthorized exfiltration of sensitive CRM data from Salesforce Agentforce by abusing the agent's broad role-based permissions without credential theft. Although the specific parsing bugs were patched, the fundamental authorization gap remains, allowing agents to access data beyond the immediate task's scope. This can lead to data leakage or misuse if agents are given overly broad permissions without task-scoped constraints. The incident undermines trust in AI agents operating with standing roles and highlights the risk of shadow delegation where the system cannot verify the intent behind each action. The impact is primarily data confidentiality loss within affected CRM systems using similar agent authorization models.

Salesforce has patched the specific URL-parsing vulnerabilities exploited in SalesBleed, closing the immediate exfiltration path. However, the broader authorization design issue remains unaddressed by patching alone. Organizations should adopt task-scoped permission models for AI agents, granting authority narrowly and specifically per task rather than broad role-based access. Implementing verifiable, short-lived authorization tokens that carry task context (such as Tenuo's 'valet key' or 'warrant' model) can prevent shadow delegation attacks. Until such models are deployed, limit AI agents' permissions to the minimum necessary and monitor for anomalous data access patterns. Vendors and integrators should evaluate their agent authorization frameworks to ensure they support task-scoped authority and verifiable delegation.