Three "SalesBleed" Flaws Let Attackers Bleed Data Out of Salesforce Agentforce Without a Single Click
Researchers at Zenity Labs disclosed a set of three vulnerabilities in Salesforce Agentforce, Salesforce's AI-agent platform, collectively dubbed SalesBleed. Two of the flaws abused weaknesses in Trusted URLs — Agentforce's mechanism for blocking untrusted external links and images — to achieve zero-click CRM data exfiltration, while a third abused Agentforce's Slack integration to let attackers hijack an agent's identity and post phishing messages inside a victim organization's own Slack workspace. The attack chain started at an intentionally unauthenticated entry point: Salesforce's Web-to-Lead forms. An attacker could embed a hidden prompt-injection payload in a submitted lead that stayed dormant until an employee simply asked an Agentforce agent to process that lead — at which point the agent executed the attacker's hidden instructions on its own, with no additional click, credential theft, or direct access to the target's Salesforce environment required. Zenity reported the issues to Salesforce on June 1, 2026, and Salesforce confirmed all three were remediated by August 19, 2026, reporting no evidence of in-the-wild exploitation.
Incident Details
| Attribute | Value |
|---|---|
| Vulnerability Set Name | SalesBleed |
| Affected Product | Salesforce Agentforce (AI agent platform), including its Web-to-Lead and Slack integrations |
| Number of Flaws | Three |
| Disclosed By | Zenity Labs |
| Reported to Salesforce | June 1, 2026 |
| Remediation Confirmed | August 19, 2026 |
| Exploitation Requirement | Zero-click (two flaws) — payload executes automatically once an agent processes a poisoned lead |
| Attacker Access Needed | None — no authentication into the target's Salesforce org and no victim interaction required |
| Evidence of Exploitation | None found, according to Salesforce |
How the Flaws Work
Flaw 1 and 2: Trusted URLs Bypass Enables Zero-Click CRM Exfiltration
The first two vulnerabilities exploited multiple weaknesses in Trusted URLs, the control Salesforce built to stop Agentforce from rendering or fetching links and images from untrusted sources. According to Zenity, the mechanism failed to properly recognize top-level domains and could be tampered with using specific character sequences, allowing an attacker's domain to slip past the allowlist logic. An attacker would embed a hidden prompt-injection payload inside a Web-to-Lead submission — a form Salesforce intentionally leaves unauthenticated so prospective customers can submit contact details. The payload remained dormant in the CRM until an employee asked an Agentforce agent to process or summarize that lead, at which point the agent read the injected instructions as if they were legitimate business content and acted on them, querying sensitive fields from the leads and accounts tables.
Flaw 1 and 2 (continued): HTML Image Tags as an Exfiltration Channel
To get the stolen data out, the payload instructed the agent to embed it in HTML image tags pointing at an attacker-controlled server. Because the frontend rendered and fetched external image URLs in these tags without additional sanitization or requiring user interaction, Agentforce would silently issue an outbound request carrying the encoded CRM data — including company names, deal sizes, and other account fields — to the attacker's server. In some cases, Salesforce's own interface reported that content had been blocked by organizational security policy even though the sensitive data had already been transmitted, giving victims a false sense that the exfiltration attempt failed.
Flaw 3: Slack Integration Hijack Enables Anonymous Phishing
The third flaw targeted Agentforce's integration with Slack. A malicious Web-to-Lead payload could hijack an Agentforce agent connected to Slack and cause it to post messages into internal Slack channels using the agent's own trusted identity, because the underlying Reply to a Slack Thread Agentforce action did not require user confirmation before sending a message and did not attribute the message to the human who actually triggered it. That combination let an attacker turn a company's own AI agent into a phishing delivery mechanism — employees would see a message arrive from a system already trusted and operating inside their workplace, rather than from an unfamiliar external sender, making credential-harvesting links or social-engineering pretexts far more convincing. Zenity also noted that in some Agentforce-to-Slack configurations, Slack's automatic link-preview ("unfurling") behavior could independently trigger a request that leaked encoded data without any recipient interaction at all.
Impact Assessment
| Impact Area | Description |
|---|---|
| Data Confidentiality | Sensitive CRM fields — company names, deal sizes, account and lead data — could be silently exfiltrated with no victim click and no attacker authentication |
| Trust in AI Agent Identity | The Slack flaw let an attacker impersonate a trusted internal system, undermining employees' ability to distinguish legitimate agent output from attacker-controlled messages |
| Phishing and Credential Theft Risk | Employees tricked by an "internal" Slack message could surrender credentials, potentially exposing email, Slack, source code, and other internal systems |
| False Sense of Security | Salesforce's own blocked-content notifications appeared even after data had already left the environment, delaying detection |
| Attack Surface Pattern | Demonstrates a repeatable AI-agent risk: attacker-controlled input (unauthenticated forms), broad tool/data permissions, and an outbound communication channel combined under a single agent identity |
| Scope | Salesforce has not published a count of affected customers; the flaws were confirmed fixed platform-side before any known exploitation |
Recommendations
For Salesforce Administrators
- Audit and narrow Agentforce tool permissions so agents can only access the specific CRM objects and fields required for their function, rather than broad leads/accounts access by default
- Enforce tightly scoped Trusted URL allowlists rather than relying on default domain-matching behavior, and re-verify the allowlist after this fix to confirm the top-level-domain recognition issue is resolved in your org
- Review Web-to-Lead form configurations and treat all externally submitted fields — company name, notes, custom fields — as untrusted input that could contain hidden instructions, not as trusted business content
- Require explicit user confirmation before any Agentforce action that sends outbound messages, including Slack replies, email, or other communication-channel integrations
- Confirm the August 19, 2026 remediation is applied to your org and review Salesforce's release notes for any configuration changes needed on your end
For Security Teams
- Treat AI agents as a new insider-threat-equivalent identity class — an agent with broad data access and an outbound channel can be weaponized the same way a compromised employee account can
- Monitor outbound requests triggered by agent actions, particularly image/link rendering and third-party integration calls, for unexpected destinations
- Extend phishing-awareness training to cover AI-agent-originated messages, since employees are conditioned to trust internal systems like Slack bots and CRM assistants
- Include prompt-injection scenarios via unauthenticated intake forms (lead forms, contact forms, support tickets) in red-team and tabletop exercises for any AI agent connected to your CRM
- Validate that "blocked content" notifications actually reflect blocked transmission, not just a post-hoc warning after data has already left the environment
Key Takeaways
- Zenity Labs disclosed three vulnerabilities in Salesforce Agentforce, collectively named SalesBleed, that combined to allow zero-click CRM data theft and agent-identity phishing.
- Two flaws exploited weaknesses in Agentforce's Trusted URLs control, allowing prompt-injected payloads delivered via unauthenticated Web-to-Lead forms to exfiltrate CRM data through HTML image tags with no victim interaction.
- A third flaw abused the Slack integration's lack of send confirmation and sender attribution, letting attackers hijack an agent's trusted identity to post phishing messages inside internal Slack channels.
- The attack required no authentication into the target's Salesforce org and no click from the victim — submitting a poisoned lead was enough to seed the exploit chain.
- Zenity reported the flaws on June 1, 2026, and Salesforce confirmed remediation by August 19, 2026, with no evidence of exploitation found in the wild.
- SalesBleed illustrates a broader AI-agent security pattern: combining attacker-controlled input, broad data access, and an outbound communication channel under one agent identity is enough to enable serious compromise without any traditional privilege escalation.