Vulnerabilities in SalesBleed: 3 (Source: Zenity Labs, as reported by SecurityWeek (September 27, 2026))
What Zenity Labs found
Zenity Labs reports three vulnerabilities in Salesforce Agentforce, together named SalesBleed. They could have allowed attackers to hijack trusted agents for sensitive CRM data exfiltration and phishing, according to SecurityWeek's report on the research. Salesforce confirmed that all three bugs had been addressed by August 19.
The entry point was Web-to-Lead, Salesforce's official lead-collection mechanism, which also provides a direct path to the CRM. Malicious instructions placed in a lead stay dormant until an employee asks an Agentforce agent to interact with the submission. The agent then processes the poisoned lead and executes the hidden instructions. No employee has to click a link or approve an action for the exfiltration path to work.
Where the control fell short
The first two flaws came from multiple weaknesses in Trusted URLs, the mechanism designed to block Agentforce from displaying URLs and images from untrusted sources. Zenity Labs found that it did not recognize top-level domains, and that certain character sequences could tamper with URL parsing. A Web-to-Lead payload could read data from the leads and accounts tables. It could then use HTML image tags to send that data to an attacker's server.
The status message the agent returned is the detail most relevant to a budget-holder. Zenity Labs says: "Agentforce reported that the content had been blocked by the organization's security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server." In this case, the agent's own report of a control decision did not match what had happened.
A second route ran through Slack. Zenity Labs says the integration automatically retrieves link information for previews, so "specially constructed links can cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear."
An agent acting under a trusted identity
The third flaw concerned the Agentforce-Slack integration. Because the agent did not identify the user sending the message, an attacker could use a malicious Web-to-Lead submission to hijack the agent. The attacker could then post phishing messages to various internal Slack channels under the agent's identity.
Zenity Labs describes the effect this way: "Employees receive a message from a trusted system already operating inside their workplace rather than from an unfamiliar outside sender." Users who follow the link and surrender credentials could give attackers access to email, Slack, source code repositories and other enterprise applications available through the compromised identity.
Scope of the finding
This is one disclosure about one vendor's agent platform. The SecurityWeek report describes research findings and vendor fixes. It does not describe exploitation outside Zenity Labs' work. The underlying pattern is a system that lets externally supplied text reach an agent holding internal data access and outbound channels, and that pattern is not specific to Salesforce. That makes the questions below worth putting to your own team.
What to ask your team
1. Which of our AI agents process text that originates outside the organisation, such as form submissions, inbound email or support tickets? For each one, what data and channels can it reach?
2. Do we log outbound requests triggered by agent-rendered content, including images and link previews, independently of the agent's own status messages? Zenity Labs' example shows a block message and a completed transfer coexisting.
3. Does each agent identify the person making a request, and does it act with that person's permissions or with its own broader identity?
4. Have we confirmed with each vendor that the SalesBleed fixes apply to our Agentforce and Slack configuration, and who owns that confirmation?
5. If an agent posts to internal channels, how would an employee tell an agent-originated message from a legitimate one, and is that path covered in phishing awareness training?
