Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Zenity submitted crafted content through an unauthenticated Web-to-Lead form. During a normal internal user request, Agentforce read the CRM record with its existing rights and emitted data through an HTML image/Slack unfurl DNS path, bypassing Trusted URLs handling.
ASSESSED SYSTEM
Pre-fix Salesforce Agentforce assistant with access to Leads and Accounts in Zenity’s controlled Web-to-Lead data exfiltration path.
OUT OF SCOPE
The controlled research does not establish a malicious customer breach, a new CRM privilege grant, or the separate 2025 ForcedLeak chain.
Architecture: Agentic / MCP System (decision tree Q2) — Q2 YES: documented agent acts through tools and keeps task state over multiple steps. Tier 3: Tier 3 representative deployment scenario, bounded to the assessed system; the report does not establish every operator tier.
Documented attack or failure path
- Unauthenticated Web-to-Lead submission stored attacker text in a CRM lead.
- An internal user made a normal request and the agent queried records it was already authorized to read.
- Injected content redirected output into an HTML image or link-unfurl DNS request that carried retrieved data.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Legitimate CRM API rights limited the source records to those already accessible to the agent; no extra privilege grant is shown.
- Vendor URL and other fixes followed the controlled finding and are not pre-fix credits.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.40 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.06–0.83 (midpoint 0.45), Tier 3 MVT 0.50 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.09 | A real API permission boundary existed but did not consistently enforce the user’s task scope; the observed bypass supports the 0.25 anchor. | The agent used its existing Leads and Accounts access, yet attacker-controlled record text redirected that access to an unauthorized exfiltration task.source: primary report |
| Cn-3Output Filtering Robustness | 0.25w 0.13 | Output filtering was present but porous on the tested URL form, supporting 0.25 rather than an absent-filter zero. | The controlled chain bypassed Trusted URLs or URL redaction using encoded domain or termination behavior in the exfiltration output.source: primary report |
Unknown, not N/A: 24 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.20 | An internal user initiates the request, after which the agent autonomously queries records and composes external output. |
| AsAttack Surface Exposure | 1.00w 0.25 | The attack entry is an anonymous public Web-to-Lead form; the representative Agentforce path receives that untrusted record. elevated |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph or DGC is published, so Cp uses the worst-case default.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.50w 0.25 | Vendor policy and URL handling required a multi-part repair; .50 is a bounded implementation assumption, not measured recovery time. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal public provenance: the original report identifies the affected path and event, but no operator assessment pack, signed configuration inventory, or repeated metric battery is published. |
| Ec — Public evaluation coverage | 0.06 | coverage 0.08 (2 of 26 applicable sub-metrics) × independence 0.80 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.35 | Evidence dated 2026-09-24; age 24 days on the workpaper reference date. Components: C_event 0.35 · C_monitor 0.70 · T_containment 0.83 · T_calendar 0.91. Binding term: C_event. Evidence reference is 2026-10-18, 24 days after the earliest substantive public evidence (2026-09-24). C_monitor = 0.70 applies the Table 44 conservative default for Tier 3 because usable public monitoring-coverage evidence is unavailable; it does not assert that the deployment had no telemetry. C_event = 0.35: Zenity reproduced unauthorized CRM data exfiltration through the pre-fix Agentforce path in a controlled test; this is a demonstrated critical invariant violation, not a reported malicious victim breach. No targeted post-event re-attestation is published for the bounded pre-fix assessment. The persisted CRM lead is external task input; the public report does not establish qualifying agent-writable memory, messaging state, self-modifying configuration or a feedback decision loop. baw remains false. These caps describe public-evidence confidence and do not change the normalized-assurance indicative ERS or assert an unreported operational control failure. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.17 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
5.5 midpoint, interval 1.7–9.4; Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
WHAT THIS CASE TEACHES
Existing CRM permission was real, yet task scope and output redaction failed in the controlled pre-fix chain.
Sources: Original primary report — SalesBleed Agentforce CRM data exfiltration path (2026-09-24)