Researchers at Zenity Labs uncovered three vulnerabilities in Salesforce Agentforce, collectively named SalesBleed. Two of them could be chained to steal sensitive CRM data without any user click, and a third allowed phishing messages to be sent under an agent's identity. Both Dark Reading and The Register covered the flaws, which Salesforce has fixed after working with Zenity.
The attack starts with a maliciously crafted lead submitted through a public Web-to-Lead form. The lead contains an indirect prompt injection that stays dormant until an employee asks Agentforce a question about leads. The agent then follows hidden instructions to query the Accounts table and embed the data in an image URL pointing to an attacker-controlled server, triggering a DNS request that silently leaks the data. The Register notes that Slack's URL unfurling could be abused in the same way.
The third vulnerability exploited Agentforce's Reply to a Slack Thread action, which did not require user confirmation. Combined with the URL-redaction bypass, it allowed an internal user or external attacker to send phishing links that appeared to come from the agent itself. Dark Reading frames this as a wider warning: agentic AI can smuggle instructions from the web into trusted internal channels.
Zenity CTO Michael Bargury said the incidents show how difficult it is to keep agents contained, and that secure-by-design may not be enough once agents meet the real world. The two reports agree that the specific attack chains are closed, but the same ingredients — agents that read external records, render URLs, and hold tool access to sensitive data — are common across many agentic systems.