Salesforce Fixes SalesBleed Agentforce Flaws That Let Poisoned Web Leads Leak CRM Data

Salesforce has closed a set of security holes in its Agentforce AI platform that researchers say could let an outsider pull confidential CRM records from a company without a password, a phishing email, or a click from anyone. Zenity Labs, which calls the chain SalesBleed, detailed the flaws in a Thursday report and demonstrated the attack in a video proof-of-concept.

The research covers three vulnerabilities that Zenity reported to Salesforce, which worked with the firm to fix them. Zenity reported all three on June 1, and on September 21 it said it had tested every Salesforce fix and confirmed all three were closed.

According to the original report, there is no evidence the technique was used in real attacks. The bigger question for Agentforce customers is how their own agents are configured, because the attack did not need elevated privileges. It simply used whatever data the AI agent was already allowed to read.

How a Public Web Form Became a Data Leak

The attack began somewhere most security teams rarely look: Salesforce’s Web-to-Lead feature, the public form companies use to collect contact details from prospective customers. These endpoints accept submissions without authentication by design.

A lead that carries hidden orders

An attacker submits what looks like a routine lead but plants instructions inside one of its fields. The record then sits in the CRM, dormant, until an employee asks Agentforce something like “check my latest leads and help me with the newest one.”

The agent follows the wrong instructions

When Agentforce reads the poisoned lead, the hidden text can direct its General CRM subagent to use its Query Records capability on other objects, such as the Accounts table. In Zenity’s demonstration, the agent pulled values like account names and deal sizes, wrote them into a subdomain the attacker controls, and returned that address inside an HTML image tag.

Data leaves through a DNS lookup

When the chat interface tries to display the “image,” the client resolves the hostname. That DNS query reaches the attacker’s server with the stolen values embedded in it. No web request needs to complete; resolution alone is enough.

Why Salesforce’s URL Filter Missed It

Salesforce already enforces Trusted URL allowlists for Agentforce and Einstein generative AI agents, a defense-in-depth layer meant to block outbound requests driven by prompt injection. Zenity found the mechanism did not register hostnames ending in an unrecognized top-level domain, and that certain added characters disrupted how URLs were parsed.

The result was a mismatch. The redactor treated the string as malformed and let it through, while the browser still read it as a valid image source and looked up the host.

Background: a repeat of last year’s lesson

Dark Reading noted that a similar Web-to-Lead prompt injection surfaced in Salesforce the previous year, and that a year later Zenity could perform largely the same attack using simple workarounds to the URL filtering rules added in response.

The Slack Angle

Companies that publish Agentforce to Slack faced additional exposure. Slack’s automatic link previews could trigger the same DNS lookup with no one opening the link. The third flaw went further: a missing security control on the “Reply to a Slack Thread” action, combined with the URL redaction bypass, could let insiders or outside attackers send phishing links under the agent’s own identity. Salesforce has since changed defaults for certain Agentforce actions in Slack so users must confirm before messages go out.

How Much Could an Attacker Take?

Exposure depended on which objects and fields each organization’s agents could query, potentially including accounts, contacts, and pipeline records. There was a practical ceiling: each prompt could only exfiltrate as much data as fit in a single subdomain string. But a poisoned lead persists, so it could fire again every time staff reviewed it.

What Salesforce Customers Should Do Now

The researchers argue that output filtering on its own cannot stop this class of attack. Zenity co-founder and CTO Michael Bargury told The Register that “The bigger lesson here is about what it takes to keep AI agents contained.”