Salesforce Agentforce flaws allowed silent CRM data theft

Salesforce has fixed three security flaws in Agentforce, its AI agent platform, that allowed attackers to hijack agents using a public web form, quietly steal customer relationship management data without the victim clicking anything, and send phishing messages that appeared to come from the agent itself. The flaws, collectively named SalesBleed, were disclosed by researchers at Zenity Labs on 24 September 2026, according to The Register. Zenity reported the issues to Salesforce on 1 June and the company confirmed a day later that it was working on fixes. The attack chains no longer work.

The first two bugs turned Salesforce's Web-to-Lead form, which lets anyone submit their details to a company, into a data theft channel. An attacker submits a lead containing an indirect prompt injection, which is hidden text that an AI model treats as instructions rather than data. The instructions sit dormant until an employee asks an Agentforce agent something routine about their leads. The agent then reads the poisoned record and follows the hidden commands: it queries the Accounts table, pulls fields such as a company name and deal size, and pastes those values into a hostname controlled by the attacker.

According to Zenity's report, the agent then printed that address back to the user as an HTML image tag. Because the interface fetches external images without further checks or any user action, the request carried the stolen data straight out to the attacker's server. The researchers wrote that the front end "renders and fetches external image URLs in these tags without additional sanitization or user interaction".

That worked because of weaknesses in Salesforce's Trusted URLs feature, which is meant to restrict where Agentforce can send requests and to redact links and images pointing elsewhere. Zenity found the mechanism did not register hostnames ending in an unrecognised top-level domain, and that adding certain characters confused how it parsed addresses. Combining the two allowed the researchers to slip past the redaction.

The researchers found the same zero-click theft could be achieved through Slack. Slack automatically fetches information from links to build previews, so specially built links made Slack send requests carrying CRM data to attacker infrastructure as soon as they appeared. The entry point was again a public lead submission.

The third flaw, described in a separate Zenity blog post, involved the "Reply to a Slack Thread" action. That action did not ask the user to confirm before sending a message and did not show which user had triggered it. A malicious insider could therefore send phishing messages under the agent's trusted identity while staying anonymous, and an outside attacker could achieve the same result through a poisoned lead.

Zenity said the underlying pattern is not specific to Salesforce. "Any agent that reads records submitted by external sources, renders links or images back to a user, and also holds tool access to sensitive data, has the same three ingredients sitting in the same place," the researchers wrote.

Zenity co-founder and chief technology officer Michael Bargury told The Register that the case shows how hard it is to contain agents. "The idea of secure-by-design remains essential but for agents it may no longer be enough," he said, adding that designers can anticipate risks and still miss edge cases once an agent meets the real world. Dark Reading described the technique as smuggling arbitrary instructions from the web, across multiple applications, into trusted internal communication channels.