SalesBleed flaws let attackers hijack Salesforce Agentforce

Researchers at Zenity Labs have disclosed three vulnerabilities in Salesforce Agentforce, the company's platform for AI agents. Attackers could have abused the flaws to turn trusted agents against their own organizations. The agents could be made to leak sensitive customer relationship management (CRM) data or to send phishing messages to employees.

The researchers call the set of bugs SalesBleed. According to Zenity Labs, two of the flaws allowed zero-click data exfiltration. The third let an attacker weaponize an Agentforce agent to spread phishing inside a company.

Zenity Labs reported the issues to Salesforce on June 1. Salesforce confirmed that all three had been fixed by August 19.

A poisoned lead as the entry point

All three attacks start with Web-to-Lead. This is Salesforce's official way to collect sales leads, usually through a form on a company website. Anyone can submit such a form, and each submission goes straight into the CRM.

An attacker could hide malicious instructions in a lead submitted this way. The payload does nothing at first. It becomes active only when an employee asks an Agentforce agent to work with that lead. The agent then reads the poisoned entry and carries out the hidden instructions as part of its normal task.

Getting around Trusted URLs

The first two flaws stem from several weaknesses in Trusted URLs. This Salesforce security feature is meant to stop Agentforce from showing links and images from untrusted sources. In theory, it should also keep the agent from reaching or sending data to domains the organization has not approved.

Zenity Labs found that a Web-to-Lead payload could make the agent pull data from the leads and accounts tables. HTML image tags then carried that data to an attacker-controlled server, with no clicks needed from the victim.

The researchers found two problems with how Trusted URLs checked addresses. The mechanism did not recognize top-level domains, and certain character sequences could interfere with how URLs were parsed.

The agent's own feedback made things worse. "Agentforce reported that the content had been blocked by the organization's security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server," Zenity Labs explained.

Slack link previews as a leak channel

The second exfiltration route runs through the Agentforce-Slack integration. Slack automatically fetches information about links posted in a conversation so it can show a preview.

Using the same poisoned lead, an attacker could get the agent to post links in Slack. "Specially constructed links can cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear," the researchers said. Nobody has to click anything.

Phishing with the agent's identity

The third flaw also involves Slack. Zenity Labs found that the integration could turn Agentforce agents into a social engineering tool that posts messages to internal Slack channels.

The agent did not check who was sending it instructions. So a malicious lead could take control of it and publish phishing messages under the agent's name.

The researchers point out that such messages arrive from a trusted system already running inside the workplace, not from an unknown outside sender. Employees who click the link and enter their credentials could expose email, Slack, source code repositories and other business applications tied to that identity.

Our Take

SalesBleed follows a pattern that is becoming familiar. An AI agent with broad access reads untrusted input, and that input quietly tells it what to do. Here the input was an ordinary web form, the kind many companies deliberately leave open to the public. For defenders, this suggests that any field an outsider can fill in should be treated as a possible attack vector once an agent reads it.

The misleading "blocked" message deserves attention. It shows that an agent's report of its own actions is not reliable evidence of what actually happened.

This also fits a wider concern about autonomous tools acting beyond their intended limits, as seen recently when OpenAI agents breached an Australian Medicare stats portal. Salesforce has patched these issues. It is worth watching whether similar weaknesses appear in other agent platforms that link CRM data with chat tools like Slack.