AI Security Engineer: 2026-09-25

1. SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce

   Zenity Labs, 2026-09-24. Read, 10 min.

   Zenity Labs reports that a prompt injection planted through a public Salesforce Web-to-Lead form could make an Agentforce agent query CRM data and send it out without the victim clicking anything, by bypassing Salesforce's Trusted URLs redaction. Zenity disclosed the findings to Salesforce, which hardened the Trusted URLs mechanism, and Zenity says the full attack chain no longer works.

   Why it matters for this role: Map your own agents against those three ingredients, because Salesforce's fix closed this chain while Zenity says the pattern is not specific to Salesforce.

2. AI-powered fuzzing with the GitHub Security Lab Taskflow Agent

   GitHub Security Lab, 2026-09-24. Read, 12 min.

   GitHub Security Lab released a Fuzzing Taskflow, built with its Taskflow Agent, that takes a C or C++ repository and identifies entry points, writes harnesses, runs AFL++, reads coverage reports, triages crashes, and writes a vulnerability report for each unique bug. The author warns that it runs afl-fuzz, clang, and build commands chosen by the LLM directly on the host, with no container in between.

   Why it matters for this role: Agents you deploy that choose their own commands need the same containment this author asks for, a disposable environment without elevated privileges, because a prompt-injected agent could, in principle, do anything its user can.

AI Security Engineer