Salesforce has fixed three security flaws in its Agentforce platforms that could have allowed attackers to use the company’s own AI agents to steal sensitive CRM data or send phishing messages through Slack.
Dubbed “SalesBleed,” security researchers at Zenity Labs discovered that an attacker could hide malicious instructions inside a Salesforce Web-to-Lead form, which companies commonly use to collect information from potential customers. And once the submission entered a company’s CRM, the instructions could remain there until an employee asked Agentforce to review the lead.
For Agentforce, the employee did not need to open the suspicious submission, click a malicious link, or approve the transfer of information. Agentforce could read the hidden instructions while handling the employee’s normal request and use its existing access to retrieve other information stored inside Salesforce.
How SalesBleed Allowed Attackers to Reach CRM Data
The attack took advantage of how Agentforce works with information stored inside Salesforce.
Zenity found that the General CRM subagent it tested could access both lead information and records stored in the Accounts table. This meant a malicious instruction hidden in a lead could tell the agent to move beyond reviewing that lead and retrieve other information it already had permission to access.
The researchers demonstrated the attack using company names and deal sizes from Salesforce accounts. According to Zenity, the same method could potentially reach other information available through the agent’s Query Records tool, depending on what data the agent was allowed to access.
However, the attacker did not need a Salesforce account or access to the company’s systems to plant the instructions, as Web-to-Lead forms are deliberately public because businesses use them to receive enquiries from prospective customers.
Why the Attack Did Not Require a Click
Salesforce already had a protection called Trusted URLs that was meant to prevent Agentforce from returning links and images from websites that had not been approved. However, Zenity found weaknesses in how the system recognised certain web addresses.
The researchers were able to place CRM information inside a specially formed web address and make Agentforce return it as part of an image request. When the browser tried to locate that address, a DNS request was sent to a server controlled by the researchers, carrying the CRM information with it.
This happened automatically after Agentforce processed the poisoned lead, and the employee only had to make an ordinary request such as asking the agent to check the latest leads. But the employee never had to interact with anything submitted by the attacker.
Zenity also found another route through Slack. Because Slack can automatically fetch links to generate previews, an Agentforce response containing the malicious address could trigger the same type of data transfer without anyone clicking it.
A third vulnerability went further by allowing Agentforce to send Slack messages without showing who had instructed the agent to send them and without requiring confirmation. Zenity showed that this could be combined with a poisoned lead to make the agent send phishing messages under its own trusted identity.
Salesforce Has Fixed the Agentforce Flaws
Zenity first reported the vulnerabilities to Salesforce in June. The company then later strengthened its Trusted URLs system, added information showing who triggered Agentforce Slack messages, and changed the affected Slack action so that user confirmation is required by default. Afterwards, Zenity confirmed the fixes in August, before publishing its research in late September.
In an updated statement, Salesforce told SecurityWeek that it had no evidence that the reported vulnerabilities had been exploited against any customer. The company also described prompt injection as an evolving challenge across the AI industry and said it would continue strengthening Agentforce against similar attacks.
SalesBleed Is Not Agentforce’s First Web-to-Lead Flaw
SalesBleed is also not the first time Salesforce’s Web-to-Lead feature has been used to target Agentforce through prompt injection. In July 2025, researchers at Noma Security reported a vulnerability called ForcedLeak that allowed attackers to hide malicious instructions inside Web-to-Lead submissions and use Agentforce to extract CRM data.
Salesforce responded by introducing additional security controls, including enforcing Trusted URLs for Agentforce and Einstein AI from September 8, 2025. The system was designed to stop agents from sending information to websites that had not been approved by an organisation. ForcedLeak was publicly disclosed later that month.
All together, these findings raise a wider security problem for AI agents that are increasingly being given access to company data and workplace tools. The more access these systems receive across CRM tools, workplace messaging, and other business software, the more important the controls around what information they trust and what actions they can perform become.
As such, protecting those systems depends not only on stopping malicious instructions from reaching the AI, but also on controlling what the agent can access and what it can do when those instructions get through.
