Researchers discovered two attack chains in Salesforce Agentforce. Agentforce could be exploited to leak CRM data and to post phishing messages in Slack.
The vulnerabilities relied on indirect prompt injection, where an attacker hides instructions in data that an AI agent later processes. In this case, it involved a lead that entered Salesforce via Web-to-Lead.
Salesforce has since resolved the reported issues. The researchers at Zenity Labs published their findings with a flair for the dramatic under the name ‘SalesBleed’.
Data leakage without a click
An attacker submitted a seemingly normal lead containing a hidden instruction. When an employee asked Agentforce to review the latest leads, the agent read that instruction. The same CRM sub-agent had access to both Leads and Accounts, allowing it to query company names and deal sizes from the Accounts table.
Agentforce then placed that data into a hostname controlled by the attacker. The chat environment attempted to load that hostname automatically via an HTML image. The subsequent DNS query contained the data within the subdomain. The employee did not need to open a link and did not see the malicious payload.
Bypassing URL security
Agentforce uses Trusted URLs to remove unapproved links from responses. However, Zenity Labs combined two discrepancies in URL processing. The security system failed to recognize certain top-level domains and handled trailing characters differently than the browser and the chat environment.
As a result, a technically invalid URL could still be processed by the browser as an image source. The DNS query was sufficient to intercept the data. A subsequent HTTP request could fail without undoing the data theft. Furthermore, a malicious lead remained in Salesforce and could be executed again with every new assessment.
Agentforce as a phishing channel
A second attack exploited the Slack integration. A command to respond to Slack messages did not require confirmation by default and did not show which user had initiated the action. This allowed an internal attacker to have Agentforce post a phishing message without the recipients being able to trace the actual sender.
An external attacker could also trigger the action via a malicious lead. As soon as an employee had Agentforce review that lead, the agent could post a message in a relevant Slack discussion. The previously discovered URL bypass made it possible to hide a phishing link behind innocent text.
Resolved, but risk remains
Salesforce confirmed the reports and updated Trusted URLs. Slack messages also received proper attribution, and a confirmation was added for the write action involved. Zenity Labs confirmed on September 21 that all fixes had been tested.
According to the researchers, the risk extends beyond Salesforce. Any AI agent that reads external data, has access to sensitive information, and can generate links or messages contains the same combination of risks. Organizations should therefore primarily audit AI agent permissions and confirmations for write actions.
SalesBleed shows how a public input channel can evolve into a persistent point of attack. While the specific attack chains are closed, untrusted data remains a problem as soon as AI agents process that data with broad access rights.