The public form for collecting leads was enough for someone else's instruction to get inside Salesforce and forced the corporate AI agent to withdraw CRM data without a single employee click. Zenity Labs has revealed the SalesBleed chain of three Agentforce issues, where the Web-to-Lead external record turned into an indirect prompt injection, and the trusted agent continued the attack already inside the corporate environment.
The attacker had enough to send a specially prepared lead through Web-to-Lead, a staff mechanism of Salesforce to collect applications from public sites. The malicious instruction was kept in the CRM as a regular record and could remain invisible for a long time. When the employee later asked Agentforce to process the fresh lead, the agent read the implemented text as part of the task and could access other Salesforce records within the rights available to the user.
The first problem allowed you to bypass Trusted URLs, a mechanism that should block links and images from mistrusted domains. The check incorrectly handled some domain zones and special character sequences. After bypassing the filter, Agentforce could get information from the Leads and Accounts tables, embed them in the image address and return the HTML tag. When downloading the image, the browser sent a request to a controlled attacking server, so the data left the CRM automatically. Such a scenario shows well why an AI agent with access to corporate APIs is actually becoming a new privileged user.
The behavior of the defense is particularly revealing. Agentforce could tell the employee that the content was blocked by security policies, although the request with sensitive information had already managed to go out. For demonstration, the specialists used the names of the companies, the size of the transactions and the e-mail address, but in the same way it was possible to transmit other CRM data available to the agent.
The second version of SalesBleed carried out the leak in Slack. The messenger automatically uploads data to links to form a preview. The specially prepared address forced Slack to turn to the infrastructure of the intruder immediately after the link appeared in the message. The user again did not need to click anything, and the stolen information was transmitted together with the network request.
The third problem affected the action of Reply to a Slack Thread from the standard Slack Knowledge set. Agentforce could publish messages in work discussions without mandatory confirmation and without the understandable indication of who initiated the shipment. Combined with an infected lead, such a chain of trust allowed an external attacker to turn a corporate agent into a source of phishing messages inside Slack.
The danger was heightened by the fact that the malicious record remained in the Leads table. Each new request in addition to the same lead gave the introduced instructions another chance to work. Salesforce received information about the problems on June 1. The correction of the Trusted URLs confirmed on August 19, the correct attribution of messages in Slack checked on August 20, and by September 21 the team confirmed the correction of the entire described chain. Now dangerous actions in Slack by default require user confirmation.
SalesBleed continues a series of cases when the interface promises a person control after the agent has managed to perform a sensitive action. In September, a similar problem was found in Kiro, where the work data could go to the attacker's server even before the user pressed the resolution button.
Salesforce faces more traditional risks around trusted connections. At the end of 2025, the compromise of Gainsight integrations created a threat to the data of a host of Salesforce customers and once again showed how large the attack radius receives components that CRM allows to work with corporate information.
The attacker had enough to send a specially prepared lead through Web-to-Lead, a staff mechanism of Salesforce to collect applications from public sites. The malicious instruction was kept in the CRM as a regular record and could remain invisible for a long time. When the employee later asked Agentforce to process the fresh lead, the agent read the implemented text as part of the task and could access other Salesforce records within the rights available to the user.
The first problem allowed you to bypass Trusted URLs, a mechanism that should block links and images from mistrusted domains. The check incorrectly handled some domain zones and special character sequences. After bypassing the filter, Agentforce could get information from the Leads and Accounts tables, embed them in the image address and return the HTML tag. When downloading the image, the browser sent a request to a controlled attacking server, so the data left the CRM automatically. Such a scenario shows well why an AI agent with access to corporate APIs is actually becoming a new privileged user.
The behavior of the defense is particularly revealing. Agentforce could tell the employee that the content was blocked by security policies, although the request with sensitive information had already managed to go out. For demonstration, the specialists used the names of the companies, the size of the transactions and the e-mail address, but in the same way it was possible to transmit other CRM data available to the agent.
The second version of SalesBleed carried out the leak in Slack. The messenger automatically uploads data to links to form a preview. The specially prepared address forced Slack to turn to the infrastructure of the intruder immediately after the link appeared in the message. The user again did not need to click anything, and the stolen information was transmitted together with the network request.
The third problem affected the action of Reply to a Slack Thread from the standard Slack Knowledge set. Agentforce could publish messages in work discussions without mandatory confirmation and without the understandable indication of who initiated the shipment. Combined with an infected lead, such a chain of trust allowed an external attacker to turn a corporate agent into a source of phishing messages inside Slack.
The danger was heightened by the fact that the malicious record remained in the Leads table. Each new request in addition to the same lead gave the introduced instructions another chance to work. Salesforce received information about the problems on June 1. The correction of the Trusted URLs confirmed on August 19, the correct attribution of messages in Slack checked on August 20, and by September 21 the team confirmed the correction of the entire described chain. Now dangerous actions in Slack by default require user confirmation.
SalesBleed continues a series of cases when the interface promises a person control after the agent has managed to perform a sensitive action. In September, a similar problem was found in Kiro, where the work data could go to the attacker's server even before the user pressed the resolution button.
Salesforce faces more traditional risks around trusted connections. At the end of 2025, the compromise of Gainsight integrations created a threat to the data of a host of Salesforce customers and once again showed how large the attack radius receives components that CRM allows to work with corporate information.
