A stranger fills out a public "contact sales" form. Weeks later, a sales rep asks the company's AI agent an ordinary question about new leads, and the agent quietly sends deal data to a server the attacker controls. The rep sees a normal answer. That is the scenario Zenity Labs laid out this week in SalesBleed, a set of three now-patched vulnerabilities in Salesforce Agentforce. It is the second time in a year that researchers have used Salesforce's own lead-capture pipeline to turn its flagship AI agent against its customers.
Zenity published the research on September 24, and SecurityWeek and Dark Reading covered it the same week. According to the firm, two of the flaws allowed zero-click data exfiltration, meaning CRM data left the organization without an employee clicking or approving anything. The third let an attacker take over the trusted identity of an Agentforce agent connected to Slack and use it to send phishing messages inside the company. Zenity reported the issues to Salesforce on June 1, 2026. Salesforce fixed the specific Trusted URLs bypasses within about two weeks and confirmed all three bugs were addressed by August 19. No CVE identifiers were assigned. Salesforce told Dark Reading it has seen no evidence of exploitation in the wild.
A Dormant Instruction in a Public Form
Every attack chain starts with Web-to-Lead, Salesforce's standard way of turning public website form submissions into CRM records. Anyone on the internet can submit one. Zenity showed that an attacker could hide instructions in a lead submission and leave them there. Nothing happens until an employee asks Agentforce about that lead. When the agent reads the poisoned record, it treats the hidden text as instructions, a technique known as indirect prompt injection.
The main safeguard that should have stopped the data from leaving is Trusted URLs, an allowlist meant to block Agentforce from rendering links or images that point to unapproved domains. Zenity found several ways around it. According to SecurityWeek's summary of the research, the mechanism "did not recognize top-level domains," and certain character sequences confused how it parsed URLs. The hijacked agent could then look up Salesforce records and embed the results in image requests to an outside server. The data was sent automatically when the response rendered. The press release says deal sizes were only one example. Anything the querying user could see was exposed, including contacts, pricing and contracts.
Zenity's disclosure highlights one detail in particular: "Agentforce reported that the content had been blocked by the organization's security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server." In other words, the control reported a block after the data had already gone out.
The second zero-click path relied on Slack's automatic link previews. Zenity wrote that "specially constructed links can cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear." The third flaw was about attribution rather than exfiltration. The Agentforce-Slack integration could post to channels without reliably identifying which user had triggered the action. That meant a poisoned lead, or an anonymous insider, could make the company's own agent send convincing phishing messages.
"This isn't one clever bypass or a single misconfiguration. We found multiple ways to break through the security boundary designed to stop Agentforce from sending enterprise data to unapproved destinations," said Michael Bargury, co-founder and CTO of Zenity. "Hard boundaries remain one of the strongest tools we have for containing AI agents, but they are still software."
Why It Matters
SalesBleed is essentially a sequel. In September 2025, Noma Security disclosed ForcedLeak, a Web-to-Lead prompt-injection chain against Agentforce with a CVSS score of 9.4. Salesforce responded then by tightening its URL controls. Dark Reading's reporting describes Zenity's findings as simple workarounds to those same rules, one year later. Salesforce acknowledged to the publication that its earlier fix was a quick one. This time, it says it has replaced regex-based URL detection with spec-conformant parsing and sends all URL-related agent traffic through a single inspection gateway. It has also changed default settings so that certain Agentforce actions in Slack require user confirmation before sending messages.
A better parser addresses the specific bug, not the underlying design. The pattern Zenity describes applies to almost every enterprise agent platform: the agent reads untrusted outside input, holds broad read access to sensitive data, and can reach external channels. "When you give them access to both sensitive information — your accounts payable, leads, contracts, etc. — and external channels, this combination is very toxic," Tamir Ishay Sharbat, Zenity's director of security research, told Dark Reading.
The phishing flaw may be the more lasting lesson. Employees have learned to be suspicious of outside senders. They have not learned to be suspicious of the company's own AI assistant posting in an internal channel. Bargury also points to a visibility gap. He told Dark Reading that across the industry, vendors are "building black boxes," which leaves defenders with only summaries of what their agents actually did.
What to Watch
The obvious test is whether Salesforce's new parsing and single-gateway design holds up against the next group of researchers, since ForcedLeak's fix lasted less than a year. Zenity says video demonstrations of the attack chains are coming to its YouTube channel. The firm will also host AI Agent Security Summits in London on October 8 and New York on October 21, where more agent-hijacking research is likely. For Salesforce admins, the practical work is now: review which records agents can read, audit Trusted URLs and Slack agent permissions, and treat every public form field as untrusted input to an AI system.
“Hard boundaries remain one of the strongest tools we have for containing AI agents, but they are still software.”— Michael Bargury, Co-founder and CTO, Zenity