Security researchers at Zenity Labs disclosed three vulnerabilities in Salesforce Agentforce, collectively dubbed SalesBleed, that could have let attackers turn a trusted AI agent into a covert data exfiltration and phishing tool without any employee clicking a malicious link.
The attack chain begins with Web-to-Lead, Salesforce’s standard mechanism for capturing leads directly into the CRM. Zenity Labs found that attackers could embed malicious instructions inside a submitted lead. Those instructions stay dormant until an employee asks an Agentforce agent to process or interact with the poisoned lead, at which point the agent unknowingly executes the hidden commands.
Zero-Click Exfiltration via Trusted URLs
Two of the three flaws stemmed from weaknesses in Trusted URLs, the control meant to stop Agentforce from displaying content or sending data to unapproved domains. Zenity Labs demonstrated that a Web-to-Lead payload could pull data from leads and accounts tables and exfiltrate it using HTML image tags pointed at an attacker-controlled server. In testing, Agentforce reported that content had been blocked by organizational security policy, even though the sensitive CRM data had already been sent out.
The researchers traced the bypass to gaps in how Trusted URLs handled top-level domains and to character sequences that could manipulate URL parsing, effectively defeating the domain allowlist.
Slack Integration Abused for Exfiltration and Phishing
The same poisoned lead technique could reach further through Agentforce’s integration with Slack, which automatically fetches link previews. Zenity Labs found that specially crafted links could trigger Slack to send CRM data to attacker infrastructure the moment a link preview loaded, requiring no interaction from the victim.
The third flaw let attackers hijack an Agentforce agent’s identity to post phishing messages into internal Slack channels. Because the agent did not verify who triggered the message, a poisoned Web-to-Lead submission could cause it to broadcast phishing content that appeared to come from a trusted internal system rather than an external sender. Zenity Labs warned that employees who followed such links and entered credentials could expose email, Slack, source code repositories, and other connected enterprise applications tied to the compromised identity.
Disclosure and Fix
Zenity Labs reported the SalesBleed issues to Salesforce on June 1, and Salesforce confirmed all three vulnerabilities had been remediated by August 19.
The findings underscore a growing risk pattern in agentic AI deployments: attacker-controlled input entering through a legitimate business channel, such as a public lead form, can lie dormant until an AI agent processes it, at which point trusted integrations become the delivery mechanism for data theft or social engineering.