Security researchers at Zenity Labs have disclosed three vulnerabilities in Salesforce Agentforce that could have let attackers steal sensitive CRM data without a single click — using nothing more than a poisoned lead submitted through a public web form.
The flaws, branded SalesBleed, turn one of the most ordinary forms on the internet into a dormant data-exfiltration path.
The attack chain started at Salesforce's Web-to-Lead form, the standard public contact form embedded on countless company websites to capture sales leads.
An attacker could submit what looked like a normal lead while burying hidden instructions inside a form field.
When a sales rep later asked an Agentforce agent to summarize or process that lead, the agent read the embedded instructions as if they came from a trusted internal user — the textbook definition of indirect prompt injection, reported by SecurityWeek.
Two ways out, zero clicks needed
Two of the three flaws enabled zero-click exfiltration. Salesforce runs a security control called Trusted URLs, meant to block Agentforce from rendering links or images that point to untrusted domains.
Zenity Labs found that the redaction logic did not recognize certain uncommon top-level domains, including ".fun," and mishandled characters such as curly braces and square brackets during URL parsing. That gap let attackers slip exfiltration links past the filter.
Combined with standing read access the General CRM subagent holds over the Leads and Accounts tables, the hidden instructions could quietly query records — company names, deal sizes, contact details — and smuggle results out as HTML image tags that fire automatically when rendered, no click required.
A second path abused Slack's link unfurling: specially crafted links could make Slack initiate requests carrying CRM data to attacker-controlled servers as soon as the links appeared in a channel.
One detail should worry security teams more than the bugs themselves: Agentforce reported that the content had been blocked by the organization's security policies, even though the sensitive data had already been transmitted to the attacker's server, according to Zenity's disclosure.
A trusted agent turned phishing weapon
The third flaw affected the Agentforce-Slack integration. Agentforce agents can join channels, read messages, and send messages when prompted — but Zenity found the integration allowed an agent to post messages to different channels without reliably identifying the user who initiated the action.
An attacker could exploit this to post phishing messages under the trusted agent's identity, making them read as if they came from an internal system rather than an outsider.
Zenity Labs disclosed the vulnerabilities to Salesforce on June 1, 2026, and Salesforce confirmed fixes for all three by mid-August, replacing the old regex-based URL checks with standards-compliant RFC 3986 parsing. No CVEs were assigned, but the timeline — roughly 77 days from disclosure to full remediation — was notable on its own.
A pattern, not a one-off
The researchers stressed that the underlying risk pattern is not unique to Agentforce. Any AI agent that ingests untrusted external data, renders rich content back to users, and holds tool access to sensitive backend systems carries the same ingredients.
With autonomous agents spreading through CRM, HR, and support workflows, the tool-use surface — not the model itself — is increasingly where the real exposure lives.
By Hamza Faisal
