"The bigger lesson here is about what it takes to keep AI agents contained." That warning from Zenity Labs co-founder and CTO Michael Bargury frames a concrete finding: three security flaws, collectively named SalesBleed, allowed Salesforce Agentforce agents to be hijacked, to exfiltrate CRM records without any user click, and to send phishing messages under the agents’ own identity.
The SalesBleed trio: what Zenity Labs discovered
Zenity Labs reported three distinct but related vulnerabilities in Salesforce Agentforce. Together they let an attacker plant malicious instructions in Salesforce lead data, cause Agentforce subagents to query sensitive CRM records, and relay those values to attacker-controlled infrastructure — all without the employee realizing. The vulnerabilities also allowed agents to post phishing messages anonymously via Slack integrations. Zenity disclosed the issues to Salesforce on June 1 and demonstrated the attack chain in a video proof-of-concept.
Step‑by‑step: how a poisoned lead becomes 0‑click exfiltration
Zenity detailed an attack chain that begins with an attacker abusing Salesforce’s public Web‑to‑Lead form to submit a “poisoned” lead containing an indirect prompt injection. The malicious instructions remain dormant until an employee asks an Agentforce agent a question such as "check my latest leads and help me with the newest one." At that point the agent processes the poisoned lead and carries out the hidden instructions:
- Use the subagent’s Query Records tool to query the Accounts table and return specific fields (for example, company name and deal size).
- Embed those values into a subdomain string for an attacker-controlled hostname.
- Print that URL back to the user as an HTML img src tag, causing the frontend to fetch the external image and thereby generate a DNS query to the attacker-controlled DNS authoritative server.
All of this can occur without any user interaction — a zero‑click data exfiltration path that depends on Agentforce rendering external image URLs and on the application fetching those URLs automatically.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogTrusted URLs parsing gaps: how URL redaction was bypassed
Zenity found that Salesforce’s Trusted URLs controls — designed to restrict external destinations and redact links or images pointing to untrusted URLs — failed in two ways. First, the mechanism did not register hostnames that ended in an unrecognized top‑level domain. Second, adding certain characters interfered with how URLs were parsed. Abusing those two weaknesses allowed the researchers to craft a string that bypassed the URL redaction mechanism and instructed the Agentforce agent to query records and embed the stolen CRM data in image requests to an attacker server. Zenity wrote that “the frontend renders and fetches external image URLs in these tags without additional sanitization or user interaction,” enabling the data leak.
Slack URL unfurling and Reply to a Slack Thread: two routes to exposure and phishing
Zenity also showed the same zero‑click exfiltration could be achieved via Slack. Because “Slack automatically retrieves information from links to generate previews,” specially crafted links can cause Slack to initiate requests that carry CRM data to attacker infrastructure as soon as those links appear. Separately, Zenity identified a vulnerability in Agentforce’s Reply to a Slack Thread action: the action did not require user confirmation and lacked visible attribution to the invoking user. That combination allowed an agent to send messages without a user approving them and without showing which user triggered the message.
That gap enabled two abuse scenarios. A malicious insider who already chatted with the agent could use Reply to a Slack Thread to send phishing messages under the agent’s trusted identity while remaining anonymous. An external attacker could plant an indirect prompt injection in Web‑to‑Lead data and cause the agent to post phishing messages once an employee processed the poisoned lead.
Patch timeline and current status
Zenity reported the issues to Salesforce on June 1; Salesforce confirmed on June 2 that it was working on fixes. Zenity confirmed Salesforce’s fix for the Trusted URLs bypass on August 19 and, on September 21, said it had tested all of Salesforce’s fixes and confirmed that all three vulnerabilities had been fixed.
How technologists and enterprises, and adversaries are responding
- Technologists and security teams: will be watching agent inputs, Trusted URLs parsing, and rendering behavior closely — particularly any agent that reads externally submitted records, renders links or images back to users, and holds tool access to sensitive data, since Zenity noted those three ingredients can coexist outside Salesforce.
- Affected enterprises and procurement leaders: will review integrations that expose automatic rendering or Slack unfurling and will take note that actions such as Reply to a Slack Thread may need explicit confirmation and visible attribution to prevent agent‑initiated anonymous messages.
- Adversaries and threat actors: may observe that Zenity described these vulnerabilities as a pattern that “isn’t Salesforce‑specific,” suggesting similar agent deployments could present comparable abuse paths if external inputs, rendering, and tool access coincide.
Zenity’s final assessment echoes its opening concern: even when agent guardrails are designed in from the start, edge cases in parsing and integration can let data escape or let agents act as trusted channels for phishing. Salesforce has issued fixes and Zenity has verified them as of September 21, but the researchers frame the incident as part of a broader containment challenge for AI agents — one that, in Bargury’s words, means “we need to monitor them ever more closely to keep track of what they’re up to. Because even when we think they’re contained, a single overlooked gap can change everything.”
