Zenity uncovers three vulnerabilities in Salesforces Agentforce: zero-click theft of CRM data

Zenity uncovers three vulnerabilities in Salesforces Agentforce: zero-click theft of CRM data

Security firm Zenity Labs has disclosed three vulnerabilities in Salesforce's Agentforce platform, collectively named SalesBleed, which the researchers say allowed a single, anonymous web form submission to hijack a company's AI agents, exfiltrate CRM data without a single click, and send phishing messages from an agent that employees trusted. Salesforce has, according to Zenity, worked with the company to fix the flaws, and Zenity's CTO says the attack chains no longer work. The story still matters: it shows how exposed enterprise agents are to indirect instructions — and how difficult it is to build guardrails that hold.

How the attack began: a form nobody can trace

The attack chain started with one of the most mundane elements of a Salesforce deployment: the Web-to-Lead form, which lets visitors to a website register themselves as sales leads directly in the CRM system. An attacker abuses the form to plant an indirect prompt injection — hidden instructions — inside Salesforce.

The instructions lie dormant until an employee asks an Agentforce agent a question about leads, for example "check my latest leads and help me with the newest one," as The Register describes it, citing Zenity's report. The agent then processes the poisoned lead and executes the hidden instructions — for instance, querying the Accounts table for sensitive data.

According to Dark Reading, the Zenity researchers pointed to two factors that made the attack especially convenient. First, there is no way to identify, block, or otherwise punish the anonymous attacker using Web-to-Lead forms. Second, by getting an AI agent to do the work for them, the attacker could "effortlessly piggyback on the permissions Salesforce customers willingly grant their bots."

Exfiltration without a click: the weaknesses in Trusted URLs

Two of the three vulnerabilities enabled zero-click exfiltration: sensitive Salesforce data could be sent to attacker-controlled infrastructure without any employee clicking or approving anything, according to Zenity's press release.

The mechanism, as Zenity describes it, lies in Salesforce's Trusted URLs mechanism — the control meant to prevent Agentforce from sending corporate data to unapproved destinations. Zenity found several weaknesses in the control, including top-level domains (TLDs) the mechanism did not recognize, and character sequences that disrupted how URLs were parsed. These weaknesses let malicious instructions have Agentforce query Salesforce records and embed the retrieved information in image requests to an attacker-controlled server.

One particularly troubling detail, according to Zenity: in the first vulnerability case, Agentforce reported that the content had been blocked by the organization's security policies — even though the sensitive CRM data had already been sent to the attacker's server. The user thus received a security-affirming response after the leak had occurred.

"This isn't one clever bypass or a single misconfiguration. We found multiple ways to break through the security boundary designed to keep Agentforce from sending corporate data to unapproved destinations," said Michael Bargury, co-founder and CTO of Zenity, in the company's press release.

The third vector: phishing from a trusted Slack identity

The third vulnerability weaponized a different asset: the trust employees place in Agentforce agents connected to Slack. According to Zenity, attackers could use the trusted identity of such a Slack-connected agent to distribute phishing messages to employees "from within the enterprise." Dark Reading described this as the most interesting finding: an apparently modest Web-to-Lead vulnerability could be combined with normal Agentforce workflows to "phish employees from within their most trusted Slack channels."

For an employee, a message from the company's own AI agent in a familiar Slack channel is a far more credible attack vector than a classic phishing email — because the sender's identity is genuine.

The pattern: the same attack, one year later

SalesBleed did not come out of nowhere. Dark Reading reports that Salesforce had implemented URL filtering rules in response to similar Web-to-Lead findings from security firm Noma Security "last year," and that the Zenity researchers found they could carry out largely the same attack using simple workarounds around precisely those rules. That points to a structural problem: a point-filter defense against a generic attack class can be bypassed, while the attack surface — an open, anonymous intake point combined with an agent holding broad permissions — remains the same.

What is confirmed — and what is not

It is worth being precise about what the sources actually document:

• Confirmed through reporting: Zenity disclosed SalesBleed on Thursday, September 24, 2026, with a report and a video proof-of-concept; The Register and Dark Reading covered the findings the same day. Salesforce has, according to The Register, "worked with the AI agent security company to fix the issues."
• Attributed to Zenity: The technical mechanisms — the Trusted URLs weaknesses, the image requests, the false "blocked" message, and the Slack vector — come from Zenity's own press release and report. None of the available sources provide independent technical verification.
• Unresolved: There is no public statement, security bulletin, or CVE number from Salesforce in the available source material, and it is unclear whether Salesforce has changed how Trusted URLs works under the hood. The claim that the attack chains "no longer work" rests on Bargury's own assessment, not on a document from Salesforce.

Outsourced content as a design problem

Bargury offered a caveat when he spoke to The Register: although these attack chains no longer work, he said the vulnerabilities illustrate how hard it is to control what agents can access — and what happens if and when they bypass the guardrail meant to restrict that access.

That is Zenity's assessment, not an independent analysis, but it lands on a concrete architectural question for anyone rolling out AI agents with access to business systems. An agent that can read CRM data and generate outbound content is by definition a potential exfiltration and communication channel; the question is which destinations and identities it can use. SalesBleed shows that a boundary control that filters URLs can be bypassed via parsing weaknesses, that the agent's response can mislead the user about what was actually sent, and that the agent's good reputation can itself become an attack tool.

For enterprises, the practical lesson is not to overlook some firewall panic — the flaws are reported fixed — but the two things the Zenity researchers themselves point to: review what permissions the bots have actually been granted, and remember that intake points like Web-to-Lead forms turn anonymous internet users into uninvited instruction sources in the enterprise's AI systems.