Poisoned Web-to-Lead submissions made Salesforce Agentforce leak CRM data past Trusted URLs
Zenity Labs found three Salesforce Agentforce bugs that let a planted sales lead drive zero-click CRM data theft and Slack phishing. Each attack began with one poisoned lead-form submission, and Salesforce fixed all three within 79 days of Zenity's report.
The Watch · Security desk
What happened
- Zenity Labs disclosed three Salesforce Agentforce flaws, which it calls SalesBleed, that let attackers hijack trusted agents for CRM data theft and phishing.
- Instructions hidden in a Web-to-Lead submission sat dormant until an employee asked an Agentforce agent to handle that lead, and then the agent carried them out.
- Two of the flaws came from weaknesses in Trusted URLs, the control meant to block Agentforce from displaying URLs and images from untrusted sources.
- The third flaw, in the Agentforce-Slack integration, let a hijacked agent post phishing messages to internal Slack channels under its own identity.
- Zenity reported the bugs on June 1, and Salesforce confirmed that all three had been addressed by August 19.
Why it matters
- Who's exposed exposure Anyone able to submit a lead through a Web-to-Lead form could reach an Agentforce agent, so the pool of possible attackers was as wide as the form's audience.
- What it limits constraint Incident reviewers could not treat an Agentforce block notice as proof of containment, because Zenity saw that notice appear after the data had already left.
- Who's exposed exposure According to Zenity, one employee who enters credentials after an agent-sent phishing link could expose email, Slack, source code repositories and other apps tied to that identity.
- Who has to decide decision Salesforce's fixes cover three specific bugs, and Agentforce owners still have to decide which outsider-written records their agents are allowed to read and act on.
Next story · Build · 9h ago
Zenity Labs: one prompt to a public AgentCore agent could return temporary credentials tied to a default role not scoped to that agentConfirmed3 publishers
Rated on exploitability, SalesBleed was cheap. The attacker's outlay was one form submission. The trigger was an employee doing ordinary CRM work with an agent [3]. Zenity Labs classes two of the three bugs as zero-click data exfiltration [4].
The data left through an HTML image tag. A poisoned lead could read the leads and accounts tables, then use an image tag to send that data to the attacker's server [6]. Trusted URLs was supposed to stop Agentforce from sending data to unapproved domains. Zenity found it did not recognize top-level domains, and that character sequences could tamper with its URL parsing [7]. The agent's message to the user was also wrong. "Agentforce reported that the content had been blocked by the organization's security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server," Zenity Labs wrote [9].
Slack link previews were a second exfiltration route. The same poisoned lead let an attacker reach the agent through Slack, and Slack fetches link information automatically to build previews [10]. "Specially constructed links can cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear," Zenity Labs said [11]. SecurityWeek files both exfiltration bugs under Trusted URLs and the third under the Slack integration. By that sorting, the preview route is a Trusted URLs failure delivered through Slack [4][5].
The phishing bug worked because the agent did not identify who was sending it messages [12]. "Employees receive a message from a trusted system already operating inside their workplace rather than from an unfamiliar outside sender," Zenity Labs said [13].
All three attacks begin with a Web-to-Lead submission. SecurityWeek describes that mechanism as a direct path into the CRM [2][10][12]. The flaw class is an agent executing instructions an outsider wrote into a record [3]. The evidence covers lead forms only.
This is a researcher disclosure [1]. All three bugs were fixed within 79 days of Zenity's June 1 report [8][15]. SecurityWeek's report does not say whether anyone exploited them before the fixes.
What to watch
- A Salesforce advisory that assigns identifiers to the three SalesBleed bugs or tells Agentforce customers to change any configuration.
- Research testing whether outsider-written records other than Web-to-Lead submissions can carry dormant instructions that Agentforce executes.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Zenity Labs reports that three vulnerabilities in Salesforce Agentforce, dubbed SalesBleed, could have allowed attackers to hijack trusted agents for sensitive CRM data exfiltration and phishing.
- [2]
The SalesBleed flaws could be exploited via Web-to-Lead forms, Salesforce's official lead-collection mechanism, which also provides a direct path to the CRM.
- [3]
Malicious instructions injected into a Web-to-Lead lead remain dormant until an employee asks an Agentforce agent to interact with the submission, causing the agent to process the poisoned lead and execute the hidden instructions.
- [4]
According to Zenity Labs, two of the SalesBleed bugs could be exploited in zero-click data exfiltration attacks, while the third allowed attackers to weaponize an Agentforce agent to distribute phishing messages.
- [5]
The first two flaws were caused by multiple weaknesses in Trusted URLs, the security mechanism designed to block Agentforce from displaying URLs and images from untrusted sources. The third affects the Agentforce-Slack integration.
- [6]
Zenity Labs discovered that a Web-to-Lead form payload could be used to access leads and accounts table data and then use HTML image tags for zero-click CRM data exfiltration to the attacker's server.
- [7]
While Trusted URLs should prevent Agentforce from accessing and sending data to unapproved domains, Zenity Labs discovered that the mechanism did not recognize top-level domains and that character sequences could tamper with URL parsing.
- [8]
Zenity Labs reported the SalesBleed vulnerabilities on June 1, and Salesforce confirmed that all three bugs had been addressed by August 19.
- [9]
"Agentforce reported that the content had been blocked by the organization's security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server,"
- [10]
Using the same poisoned Web-to-Lead mechanism, an attacker could interact with the Agentforce agent via Slack, which automatically retrieves link information for previews.
- [11]
"Specially constructed links can cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear,"
- [12]
Agentforce's integration with Slack could be abused to send messages to internal Slack channels. Because the agent did not identify the user sending the message, an attacker could use a malicious Web-to-Lead to hijack the agent and post phishing messages to Slack using the agent's identity.
- [13]
"Employees receive a message from a trusted system already operating inside their workplace rather than from an unfamiliar outside sender."
- [14]
Users who follow the phishing link and surrender their credentials could give attackers access to email, Slack, source code repositories and other enterprise applications available through the compromised identity, Zenity Labs notes.
- [15]
79 days elapsed between Zenity's June 1 report and the August 19 date by which Salesforce confirmed all three bugs were addressed.
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comZero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk
1 article · September 25, 2026
- securityweek.com‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration
1 article · September 25, 2026
Topics and entities
Topics
- AI Agent Security
- CRM Application Security
- Prompt injection