Security researchers at Zenity Labs have detailed a set of vulnerabilities in Salesforce's Agentforce platform, collectively called SalesBleed, that let attackers use hidden instructions in ordinary web form submissions to pull sensitive CRM data out through an AI agent, DIGIT reported Monday. Salesforce has fixed the issues.

What Happened

The attack began with Web-to-Lead, the Salesforce feature that turns submissions on a company's public website form into lead records. Zenity planted prompt-injection instructions in those submissions. Nothing happened at that point. The payload activated later, when an employee asked an Agentforce agent to review the new leads and the agent read the attacker's text as instructions.

The injected instructions made the agent run unauthorized queries. The General CRM subagent's default configuration includes read access to both leads and accounts, so the agent could reach company names, deal sizes, accounts and contacts. Zenity's payload asked for company names and deal sizes, but its report noted that the injection could have requested anything the subagent's Query Records tool can reach.

RelatedClaude Code Desktop Preview Flaw Could Have Exposed Developers’ Cloud Keys, Researchers Say

Getting the data out required beating Salesforce's Trusted URLs protection, which is meant to redact links to untrusted destinations. Zenity found that the redaction logic and the browser interpreted URLs differently, including in how they handled top-level domains and characters at the end of a URL. The data was then sent through DNS requests triggered by HTML image tags, so no one had to click a link and no HTTP connection had to succeed. The victim did not need to do anything beyond their normal lead review.

A separate flaw allowed a compromised agent to send phishing messages through Slack under the agent's own identity, without asking the user for confirmation and without making clear who had authored the message.

Why It Matters

SalesBleed is a clear example of indirect prompt injection against an enterprise agent. The attacker never logged in to Salesforce or touched the victim's account. They only needed a public form that feeds data into a system an agent later reads. Any agent that processes inbound content such as leads, support tickets or emails while holding access to internal records has the same basic exposure.

Zenity framed the problem as broader than one vendor, pointing to agents that read untrusted outside data, have access to sensitive systems and are allowed to render external resources. The Slack flaw adds a second dimension: an agent trusted by colleagues can become a convincing channel for phishing inside a company.

Disclosure Timeline

Zenity reported the vulnerabilities on June 1, 2026, and Salesforce confirmed receipt the next day. Salesforce confirmed fixes on Aug. 18, and Zenity verified the Trusted URLs bypass fix on Aug. 19. All Slack-related fixes were confirmed on Sept. 21, and Zenity published its findings on Sept. 24. According to DIGIT, the complete attack chain no longer works. DIGIT's report did not include a statement from Salesforce.

What to Watch

  • Administrators should review the default permissions of Agentforce subagents, particularly read access to leads and accounts, and restrict them to what each workflow needs.
  • Treat records created from public forms as untrusted input when agents are allowed to act on them.
  • Watch whether Salesforce changes defaults or adds confirmation steps for agent actions in Slack and other channels.
  • Expect similar research against other CRM and service platforms that let agents read inbound customer data.