SalesBleed Turned Salesforce Lead Forms Into a Path for Silent CRM Theft

Three vulnerabilities in Salesforce Agentforce allowed attackers to hide malicious instructions inside Web-to-Lead submissions, creating routes to steal CRM information or distribute phishing messages through internal Slack channels.

Zenity Labs collectively named the flaws SalesBleed. Two enabled zero-click data exfiltration after Agentforce processed a poisoned lead, while the third could make the agent publish phishing content under its own trusted identity.

Zenity Labs reported the issues on June 1. Salesforce confirmed that all three had been addressed by August 19. However, no CVE identifiers, severity scores, affected version ranges, or detailed remediation instructions have been disclosed.

A public lead form became the initial access point

Salesforce Web-to-Lead is an official mechanism for collecting information from prospective customers and transferring it directly into the Salesforce CRM. That connection also gave unauthenticated outsiders a way to place attacker-controlled text where Agentforce could later encounter it.

An attacker could submit a lead containing carefully designed instructions. The content would remain inactive in the CRM until an employee asked an Agentforce agent to examine, summarize, or otherwise interact with the submission.

At that point, the agent could interpret the embedded material as instructions rather than untrusted data. This is a form of indirect prompt injection: the attacker does not communicate with the AI agent through its normal conversational interface, but plants commands in information the agent is expected to process later.

The initial submission did not itself extract the records. Human activity was needed to bring the poisoned lead into the agent’s context. Once Agentforce processed it, however, the data-transfer stage could proceed without another click, approval, or deliberate action from the employee.

Trusted URL weaknesses enabled covert data transmission

Two of the SalesBleed vulnerabilities involved Trusted URLs, a security control designed to stop Agentforce from displaying images or URLs hosted by unapproved sources.

According to Zenity Labs’ findings on the SalesBleed attack paths, the control did not correctly recognize top-level domains. Researchers also found that crafted character sequences could change how URLs were parsed.

These weaknesses allowed poisoned Web-to-Lead content to bypass the intended destination restrictions. Once the malicious instructions were processed, Agentforce could retrieve sensitive information from CRM leads and accounts tables and embed it in an outbound request.

The exfiltration mechanism used HTML image tags. Rather than rendering an ordinary image, the tag directed a request to infrastructure controlled by the attacker, with CRM information incorporated into the request. Loading the external resource therefore transmitted the data.

This technique exploits ordinary web behavior: an application rendering an image must contact the server named in the image source. If sensitive values are inserted into that URL, the receiving server can collect them from the inbound request.

The attack also created a misleading security signal. Agentforce could tell the user that organizational policies had blocked the content even though the outbound request had already exposed the information. A reassuring interface message was therefore not reliable evidence that the protection had worked.

Slack link previews created a second exfiltration route

A related technique targeted organizations using Agentforce through Slack. The messaging platform automatically retrieves information about links to generate previews, a process commonly known as link unfurling.

SalesBleed abused that automated retrieval behavior. Specially constructed links appearing in Agentforce output could cause Slack to issue requests to attacker-controlled infrastructure. Those requests could carry information extracted from the Salesforce CRM.

No employee needed to open the link for the transfer to occur. The preview-generation mechanism performed the relevant network request automatically when the link appeared, making this path zero-click at the point of exfiltration.

This route also shows why controls focused exclusively on direct browser clicks can miss AI-assisted data leakage. The external connection may originate from a server-side integration or collaboration platform rather than an employee’s workstation.

No attacker domains, request patterns, log examples, or other indicators of compromise have been published. Organizations consequently have no disclosed SalesBleed-specific indicator set to search for.

Agent identity could be abused for internal phishing

The third vulnerability affected the Agentforce–Slack integration, but its objective was impersonation rather than direct extraction through an image or preview request.

The agent did not identify the user who had originated a message. An attacker could exploit that missing attribution through a malicious Web-to-Lead submission, hijacking the agent’s behavior and directing it to publish phishing messages in internal Slack channels.

Those messages would appear under the agent’s identity. That matters because employees may assign greater trust to content posted by an approved enterprise automation tool than to messages from an unfamiliar user.

If a recipient followed a phishing link and surrendered credentials, the potential impact could extend beyond Salesforce. The compromised identity might provide access to corporate email, Slack, source-code repositories, and other enterprise applications available to that employee.

The flaw therefore created two layers of risk. The immediate issue was unauthorized messaging by Agentforce; the subsequent damage depended on whether recipients interacted with the phishing content and what permissions their stolen credentials carried.

Products, versions, and severity remain unspecified

The reported attack paths involved three connected components:

• Salesforce Agentforce
• Salesforce CRM
• The Agentforce–Slack integration

Exact affected versions have not been disclosed. It is also unknown whether exploitation depended on particular Agentforce configurations, enabled actions, CRM permissions, Slack settings, or Trusted URL policies.

No CVE identifiers have been provided for the three vulnerabilities. Consequently, no CVE-based status in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog can be established from the available information.

There is also no formal severity rating. The absence of a score does not reduce the demonstrated consequences: two flaws could expose CRM records without a final user click, while the third could exploit trust in an internal agent to distribute phishing messages.

No information has been released about exploitation outside the researchers’ testing. It is therefore not known whether attackers used SalesBleed against production environments before Salesforce completed its fixes.

Salesforce says the flaws are fixed, but guidance is limited

Salesforce confirmed that all three vulnerabilities had been addressed by August 19. The company has not provided specific patch identifiers, fixed version numbers, configuration changes, or workaround instructions.

Customers should verify through their Salesforce support and administrative channels that their Agentforce environment includes the relevant protections. That verification is especially important where Web-to-Lead, CRM data access, and Slack integration are enabled together.

In the absence of published indicators, defenders can review historical outbound connections generated when Agentforce handled externally supplied lead content. They can also examine Slack activity involving unexpected Agentforce links or messages, although no definitive SalesBleed detection pattern has been disclosed.

Administrators should additionally assess how much CRM information Agentforce can retrieve and which actions the Slack integration can perform. Restricting agent permissions and monitoring automated outbound requests can reduce exposure if a comparable prompt-injection path emerges.

SalesBleed’s central failure was not limited to the language model. The attack depended on the combination of untrusted CRM input, URL-validation weaknesses, agent permissions, HTML rendering, and Slack’s automated network behavior. Once connected, those components allowed a public form submission to cross multiple trust boundaries inside an enterprise environment.