Three vulnerabilities in Salesforce Agentforce could have allowed attackers to turn trusted AI agents against the organisations using them, enabling silent CRM data exfiltration and phishing through internal Slack channels.
Cybersecurity firm Zenity Labs disclosed the issues under the name “SalesBleed”. The flaws were found in the way Agentforce handled data submitted through Salesforce Web-to-Lead forms and in controls designed to stop the AI agent from sending information to untrusted websites.
Salesforce was informed of the vulnerabilities on June 1 and had addressed all three by August 19, according to the researchers.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Malicious lead could wait inside Salesforce until AI processed it
The attack started with Salesforce’s own Web-to-Lead feature.
Web-to-Lead allows companies to place forms on their websites so information submitted by potential customers automatically enters Salesforce as a lead.
Zenity researchers found that an attacker could submit a specially crafted lead containing hidden instructions intended for an Agentforce AI agent.
Those instructions could remain dormant inside the CRM.
The attack would activate only when an employee later asked Agentforce to read, analyse or interact with the malicious lead. At that point, the AI agent could interpret the attacker’s content as instructions rather than simply treating it as untrusted customer data.
This is a form of indirect prompt injection.
Instead of talking directly to the AI, the attacker places malicious instructions inside data that the agent will eventually process.
Two flaws allowed zero-click CRM data exfiltration
Zenity says two of the three vulnerabilities could be used to extract Salesforce data without requiring the victim to click anything.
Researchers demonstrated that a poisoned lead could instruct Agentforce to access information from Salesforce leads and accounts.
The agent could then embed that information into an HTML image request sent towards an attacker-controlled server. When the request was made, the sensitive CRM information travelled with it.
This is what makes the attack “zero-click” from the employee’s perspective.
Once the poisoned record was processed, the victim did not need to open a malicious attachment or click a phishing link for data to leave the Salesforce environment.
Zenity said Agentforce could even display a message saying the content had been blocked by the organisation’s security policies after the information had already been transmitted.
Trusted URL protections could be bypassed
Salesforce uses a feature called Trusted URLs to control which external domains Agentforce and other platform components are allowed to communicate with.
The researchers found weaknesses in how these addresses were interpreted.
According to Zenity, the security mechanism did not correctly recognise some top-level domain situations, while specially constructed character sequences could interfere with URL parsing.
Those weaknesses meant an attacker could make a destination appear acceptable to the system while directing sensitive information elsewhere.
This is particularly important for AI agents because they can access business records and take actions automatically.
A security control that blocks an employee from manually visiting an unauthorised website may not be enough if the AI agent can be manipulated into sending data there itself.
Slack integration could turn Agentforce into trusted phishing sender
The third vulnerability involved Salesforce Agentforce’s integration with Slack.
Zenity found that attackers could manipulate an Agentforce agent into posting phishing messages in internal Slack channels.
The key risk was identity.
Instead of receiving a suspicious message from an unknown external account, employees could see a message posted by an Agentforce bot that their organisation already trusted.
The researchers said the agent did not adequately identify the person responsible for the underlying instruction.
An attacker could therefore plant malicious content through Web-to-Lead and cause Agentforce to post a phishing message under the AI agent’s own identity.
Employees clicking such links could potentially expose credentials for email, Slack, source-code repositories or other corporate systems.
Slack previews created another path for data leakage
Zenity also found that Slack’s automatic link-preview behaviour could contribute to the attack.
When certain links appear in Slack, the platform automatically contacts the linked destination to retrieve information for a preview.
Researchers demonstrated that specially constructed links could cause those automated requests to carry Salesforce CRM data towards attacker-controlled infrastructure.
This again reduces the need for direct user interaction.
The data transfer can occur because a trusted enterprise application automatically processes the content rather than because an employee consciously sends information outside the organisation.
Why SalesBleed matters for enterprise AI
The vulnerabilities highlight a wider problem with AI agents that can access sensitive company systems.
Traditional software normally follows predefined commands.
AI agents are different because they interpret natural-language instructions from emails, customer records, documents and other sources.
That creates an additional attack surface: an attacker may not need to exploit conventional software code if they can manipulate the instructions the AI reads.
Salesforce itself warns that malicious instructions embedded inside connected tools can attempt to make Agentforce exfiltrate information or perform unauthorised actions. Its Agentforce security documentation describes this broader class of risk as tool poisoning and includes exfiltration and privilege escalation among the threats customers should consider.
Salesforce says vulnerabilities have been fixed
Zenity reported all three SalesBleed issues to Salesforce on June 1.
According to the researchers, Salesforce confirmed that the vulnerabilities had been remediated by August 19.
There is no indication in the SecurityWeek report that the vulnerabilities were exploited in real-world attacks before they were fixed.
Salesforce also maintains a vulnerability-testing programme for Agentforce and says discovered issues are tracked and remediated according to its internal security processes.
The disclosure nevertheless shows why enterprises deploying AI agents need to treat customer-supplied text, form submissions and external content as potentially hostile input.
Giving an AI agent permission to read CRM records, post messages or interact with connected systems means a successful prompt-injection attack can potentially inherit those same privileges.
What this means for you: Companies using AI agents should not assume that data entered through ordinary customer forms is harmless. AI systems with access to CRM records, Slack or other enterprise tools need strict permissions, outbound-data controls and monitoring for prompt-injection attempts.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
