'Salesbleed' Exploits Salesforce Agentforce to Enable Anonymous Slack Phishing

Three Chained Agentforce Weaknesses Let Attackers Bleed Data, Then Phish From a Trusted Bot

Researchers at Zenity Labs disclosed a set of three vulnerabilities in Salesforce Agentforce — collectively dubbed "Salesbleed" — that combine a slow, near-arbitrary data-exfiltration path through public Web-to-Lead forms with a flaw in Agentforce's Slack integration that lets an attacker send phishing messages that appear to come from a company's own trusted internal agent. The research was reported by Dark Reading on September 24, 2026, with related coverage from The Register. Salesforce has since worked with Zenity to fix the issues; the company says it has seen no evidence of in-the-wild exploitation, and no CVE numbers were assigned.

Details

How the Attack Chain Works

Step one: bleeding data through Web-to-Lead

The foundation of Salesbleed builds on prior research (Noma Security, disclosed roughly a year earlier) showing that Salesforce's Web-to-Lead forms — one of the few places on the internet where organizations willingly accept near-arbitrary, unauthenticated input — can be abused to slowly extract internal CRM data. Zenity's contribution shows how this "modest" data-leak primitive can be combined with an Agentforce agent's normal workflows to escalate far beyond simple data leakage.

Step two: hijacking the "Reply to a Slack Thread" action

The more severe finding centers on Agentforce's "Reply to a Slack Thread" action, which Zenity found had two missing controls:

• It did not require user confirmation before sending a message.
• It did not visibly attribute the message to the person or process that invoked it.

That combination means an agent that is tricked — or directed — into invoking this action can post a Slack message with no approval step and no indication of who or what triggered it.

Step three: two paths to a phishing message in a trusted channel

Zenity identified two distinct ways to reach the hijacked Slack action:

1. Malicious insider: someone who already has access to chat with the Agentforce bot can invoke the flawed action directly to send phishing messages under the agent's trusted identity, while remaining anonymous themselves.
2. External attacker via indirect prompt injection: an attacker plants malicious instructions inside a Web-to-Lead form submission. When an employee later interacts with the agent in a way that causes it to process that lead data, the embedded instructions hijack the agent's behavior and cause it to post a phishing message in Slack — without any employee knowingly triggering it.

Why it's convincing

Because the message is sent by the organization's own Agentforce integration with no visible attribution, it can appear to originate from a real employee or the IT help desk inside a channel staff already trust. Zenity notes the phishing payload can further incorporate a malicious link by exploiting gaps in Salesforce's trusted-URL protections, making the lure harder to distinguish from a legitimate internal message.

Impact Assessment

Salesforce's Response

Salesforce acknowledged the vulnerabilities to Dark Reading and confirmed it worked with Zenity Labs to remediate them before public disclosure; the demonstrated attack chains no longer function. No CVE identifiers were assigned, and the issues were treated as design-level fixes to the affected agent action rather than a traditional patch release.

Zenity co-founder and CTO Michael Bargury framed the broader implication: "The bigger lesson here is about what it takes to keep AI agents contained," adding that "the idea of secure-by-design remains essential but for agents it may no longer be enough."

Recommendations

For Salesforce/Agentforce administrators

• Confirm your org has received Salesforce's fix for the "Reply to a Slack Thread" action, including confirmation prompts and visible message attribution.
• Audit which Agentforce actions can post to external channels (Slack, email, etc.) without an explicit human-in-the-loop confirmation step, and restrict or add approval gates to any that lack one.
• Review Web-to-Lead form configurations for unnecessary field exposure, and monitor lead submissions for anomalous, instruction-like content that could indicate prompt-injection attempts.

For security teams evaluating any AI agent platform

• Treat any agent that (1) ingests externally submitted, unauthenticated data, (2) can render links/content back to users, and (3) holds access to sensitive internal tools as a high-risk combination regardless of vendor.
• Require confirmation and attribution controls on any agent action capable of sending messages, emails, or content to internal communication channels.
• Do not assume "trusted internal bot" traffic is inherently safe — apply the same scrutiny to agent-originated messages as to external phishing vectors.

For employees

• Treat unexpected links or requests from internal bots and integrations with the same skepticism as unsolicited external messages, particularly when they arrive in a channel you'd normally trust by default.
• Report messages from company bots that reference unfamiliar leads, requests, or urgent actions to your security team before clicking through.

Key Takeaways

1. Salesbleed chains a Web-to-Lead data-exfiltration primitive with a flawed Agentforce Slack-posting action that lacked both confirmation and attribution controls.
2. A malicious insider could send anonymous phishing messages under a trusted agent's identity; an external attacker could reach the same outcome via indirect prompt injection in a lead submission — no CVEs were assigned, and Salesforce has fixed both attack chains.
3. The underlying risk pattern — external data ingestion, content rendering, and sensitive tool access in one agent — is not unique to Salesforce and applies to AI agent platforms broadly.
4. Salesforce reports no evidence of real-world exploitation prior to the fix.
5. Zenity's research underscores that secure-by-design principles alone are insufficient for AI agents; explicit confirmation and attribution controls on agent actions are necessary guardrails.

Sources

• 'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing — Dark Reading
• Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing — The Register