The weaknesses, collectively named SalesBleed by Zenity Labs, were publicly disclosed on September 24 after fixes were completed and tested. Salesforce said it had found no evidence that the vulnerabilities had been exploited by attackers. The flaws have not been assigned CVE identifiers.
The attack chain began with Salesforce’s public Web-to-Lead feature, which allows external users to submit information that is written directly into CRM records. Researchers found that an attacker could place hidden prompt-injection instructions inside a lead submission, leaving malicious commands stored in the database until an employee later asked an Agentforce agent to review leads.
That ordinary request could cause the agent to read the poisoned record and interpret its embedded text as instructions. In Zenity’s demonstration, the compromised agent then used its existing Query Records capability to retrieve information from the Accounts table, including company names and values. No privilege escalation was required because the General CRM subagent already had access to both lead and account data.
The researchers then exploited weaknesses in Agentforce’s Trusted URLs protection, designed to redact destinations not approved by administrators. They found discrepancies between the mechanism used to identify URLs and the software rendering the agent’s output. Certain unrecognised top-level domains and terminating characters could cause the redactor to treat a crafted address as invalid while the browser still processed it.
That difference created a channel for zero-click exfiltration. The stolen CRM values could be inserted into the subdomain of an attacker-controlled address and returned through an HTML image tag. When the interface attempted to load the image, it generated a Domain Name System query carrying the information. The attacker’s authoritative DNS server could read the leaked values even if the subsequent HTTP connection failed.
A second variation worked when Agentforce was connected to Slack. Automatic URL previews could resolve an attacker-controlled hostname, producing the same DNS leakage without an employee opening the link. Zenity said the victim needed only to make a normal request to the agent about CRM information; the malicious lead, exfiltration sequence and outbound lookup required no further interaction.
A separate Agentforce weakness could also have turned the compromised agent into a phishing channel inside Slack. Zenity found that the default Slack Knowledge subagent’s Reply to a Slack Thread action could post messages without requesting user confirmation and without identifying who had triggered the action.
Researchers demonstrated that instructions planted in a CRM lead could direct Agentforce to post a phishing message into Slack. Because the reply carried the agent’s identity and lacked clear user attribution, recipients could have had less information for recognising that the message originated from an unexpected workflow.
Salesforce changed the relevant Slack defaults to require confirmation before certain actions and added attribution identifying the user. The company also hardened its Trusted URLs mechanism. Zenity reported the vulnerabilities to Salesforce on June 1, and the company acknowledged them the following day. The specific URL bypass was confirmed fixed on August 19, while all fixes were confirmed and tested by September 21.
The findings echo an Agentforce vulnerability disclosed in 2025, called ForcedLeak, which also used indirect prompt injection through Web-to-Lead data to expose CRM information. Salesforce subsequently enforced Trusted URL allowlisting for Agentforce and Einstein generative AI, but SalesBleed showed that URL-processing edge cases could circumvent that safeguard.
The broader concern extends beyond Salesforce because AI agents combine externally supplied information, privileged access to corporate systems and the ability to take actions across connected applications. A malicious instruction embedded in business data can therefore travel farther than a conventional chatbot prompt when an agent is permitted to query databases, render external content or communicate through workplace services.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
