Overview of SalesBleed Vulnerabilities in Salesforce Agentforce
Zenity Labs identified three critical vulnerabilities in Salesforce Agentforce, collectively named SalesBleed, that could be exploited to hijack trusted AI agents for sensitive data exfiltration and phishing campaigns. These flaws leveraged Salesforce’s Web-to-Lead functionality — an official mechanism for collecting leads — as a vector for injecting malicious instructions that remained dormant until triggered by user interaction with an Agentforce agent.
The first two vulnerabilities were rooted in weaknesses within the Trusted URLs security mechanism, which is designed to prevent Agentforce from loading content from untrusted domains. However, Zenity Labs found that this protection failed to properly validate top-level domains and could be bypassed using specific character sequences that interfered with URL parsing. This allowed attackers to craft Web-to-Lead submissions containing poisoned data that, when processed by an Agentforce agent, would trigger the execution of hidden instructions.
Zero-Click Data Exfiltration via HTML Image Tags
According to Zenity Labs, two of the SalesBleed flaws enabled zero-click data exfiltration attacks. Once a malicious Web-to-Lead entry was submitted, it could remain inactive in the system until an employee prompted an Agentforce agent to interact with it — such as by asking for lead details or account information. Upon processing the tainted lead, the agent would execute embedded HTML image tags that silently transmitted sensitive CRM data from the leads and accounts tables to an attacker-controlled server.
"Agentforce reported that the content had been blocked by the organization’s security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server,"
Zenity Labs noted in its findings, highlighting the stealthy nature of the exfiltration, where security alerts appeared after the data had already left the environment.
Abuse of Agentforce-Slack Integration for Phishing and Data Leakage
The third vulnerability affected the Agentforce-Slack integration. Attackers could use the same poisoned Web-to-Lead mechanism to manipulate the agent into interacting with Slack, where specially constructed links would trigger automatic link previews. These previews caused Slack to initiate outbound requests to attacker-controlled infrastructure as soon as the malicious link appeared, enabling zero-click transmission of CRM data.
Furthermore, because the Agentforce agent did not reliably authenticate the origin of messages sent via Slack, attackers could hijack the agent’s identity to post phishing messages in internal Slack channels. Since these messages appeared to originate from a trusted internal system, employees were more likely to engage with them, potentially surrendering credentials that could grant attackers access to email, source code repositories, and other enterprise applications.
"Employees receive a message from a trusted system already operating inside their workplace rather than from an unfamiliar outside sender. Users who follow the phishing link and surrender their credentials could give attackers access to email, Slack, source code repositories and other enterprise applications available through the compromised identity,"
Zenity Labs warned, emphasizing the increased risk posed by impersonation via legitimate AI agents.
Timeline and Remediation
Zenity Labs reported the SalesBleed vulnerabilities to Salesforce on June 1. Salesforce confirmed that all three flaws were addressed by August 19, following a coordinated disclosure process. The fixes likely involved strengthening URL validation in the Trusted URLs mechanism and improving authentication controls in the Slack integration to prevent unauthorized message sending and data leakage.
This case underscores the security risks associated with AI-powered agents in enterprise environments, particularly when trusted data-handling mechanisms are combined with insufficient input validation and identity verification. As organizations increasingly deploy AI agents like Agentforce for workflow automation, ensuring robust safeguards against indirect prompt injection and abuse of trusted channels becomes critical to preventing data breaches and social engineering attacks.
Source: SecurityWeek