A researcher asks Salesforce’s Agentforce assistant to “check my latest leads and help me with the newest one.” Nothing about that sentence looks dangerous. But on September 24, 2026, security firm Zenity Labs published research showing that exact request could trigger a silent data leak, no login, no click, no warning. The firm calls the bug chain SalesBleed, and it is the second time in fourteen months that Salesforce’s flagship AI agent platform has been caught leaking CRM records to outsiders through the same front door: a public lead-capture form.
Three separate flaws make up SalesBleed. Two allow zero-click exfiltration of account data straight out of a company’s CRM. The third turns a trusted Slack-integrated agent into an anonymous phishing tool. None of the three carries a CVE number, because Salesforce treats Agentforce as a hosted service it patches directly rather than shipping software customers install themselves. That distinction matters more than it sounds, and it is one of the reasons this story reaches past Salesforce’s customer base into the wider debate about how enterprises govern AI agents that read email, touch CRM records, and act inside Slack without a human checking every step.
What SalesBleed Actually Is
Zenity Labs, an AI agent security firm, found that Agentforce’s General CRM subagent could be manipulated through a public Web-to-Lead form, the same widget thousands of companies embed on marketing pages so site visitors can submit their contact details. An attacker fills out that form with a hidden instruction buried in one of the text fields. The lead sits dormant in the CRM until an employee, doing something completely ordinary, asks their Agentforce assistant to review recent leads.
At that point the agent reads the poisoned lead and follows the embedded instruction instead of, or in addition to, the employee’s actual request. According to Zenity’s writeup, the injected command told the agent to query the Accounts table, pull a company name and deal size, and encode those values into a subdomain string. The agent then printed that string back as an HTML image tag. When the interface rendered the tag, it fired an HTTPS request, and that request became a DNS query carrying the stolen data straight to a server the attacker controlled. The victim never clicked anything. They never even saw a link.
How the Exfiltration Chain Bypassed Salesforce’s Own Guardrail
Salesforce already had a defense built for exactly this scenario. It’s called Trusted URLs, a redaction layer designed to strip any link pointing to an unrecognized domain out of an agent’s response before a user sees it. Zenity found two edge cases that slipped past it. First, the redactor’s list of recognized top-level domains didn’t include .fun, which happens to be the TLD used by the interactsh out-of-band testing platform the researchers used to prove the exploit. Second, they found character-parsing quirks in how the filter identified hostnames at all, letting a malformed but still-functional URL through undetected.
Put together, those two gaps meant a control specifically built to stop agents from leaking data to untrusted destinations simply didn’t recognize the destination as untrusted. That is the pattern security researchers keep flagging about agentic AI: the failure isn’t usually the model getting “tricked” in some abstract sense. It’s a permission boundary or an allowlist that has a blind spot nobody tested against, sitting inside a system trusted with real customer data.
The Third Flaw: An Agent’s Own Identity, Weaponized
The first two SalesBleed flaws leak data outward. The third, detailed in a second Zenity Labs post, turns an Agentforce deployment into a phishing launchpad. Companies can publish Agentforce agents directly into Slack, and a default template called Slack Knowledge ships with a built-in Reply to a Slack Thread action. Zenity found that action could send messages without requiring the confirmation step Salesforce normally requires, and without attaching any indication of who or what actually triggered the message.
Combine that with the URL-redaction bypass from the first two flaws, and an attacker, internal or external, could get a company’s own trusted Agentforce bot to drop a phishing link into a Slack thread under its own name. Employees who have learned to trust messages from their internal AI assistant have no way to tell the message didn’t come from a legitimate workflow. Salesforce’s fix added proper attribution to those messages and tightened the default permissions on the Slack integration.
The Disclosure Timeline
Zenity Labs reported the findings to Salesforce on June 1, 2026. Salesforce’s engineering team acknowledged the issue and said work was underway by June 17. The Trusted URLs hardening was confirmed complete on August 18, and Zenity verified the fix the following day, August 19. Both research posts went public on September 24, 2026, roughly three months after the initial report, a cadence in line with standard coordinated-disclosure practice for a cloud-hosted service where Salesforce controls the patch rollout entirely.
Salesforce has confirmed all three issues are fixed and told reporters it has seen no evidence any of the three flaws were exploited against real customers before the patches shipped. No CVE identifiers were assigned, consistent with how Salesforce has handled prior Agentforce security issues, since the platform runs as a managed service rather than customer-deployed software.
Déjà Vu: This Happened Before, Almost to the Day
Fourteen months before SalesBleed, a different research team found almost the same hole. In July 2025, Noma Security researcher Sasi Levi disclosed ForcedLeak, a critical-severity flaw chain (CVSS 9.4) that also ran through Agentforce’s Web-to-Lead integration. ForcedLeak used the form’s Description field to smuggle in a prompt injection, then exfiltrated CRM data to an old Salesforce-related domain that had expired and gone up for resale, for roughly $5, according to Noma’s research. Salesforce responded by rolling out Trusted URLs Enforcement for Agentforce and Einstein AI on September 8, 2025, and Noma’s findings went public on September 25, 2025.
That is the exact control Zenity Labs bypassed a year later, and the public disclosure dates for the two research chains land within 24 hours of each other on the calendar, one year apart. Same entry point, same underlying CRM feature, same defensive mechanism, defeated a second time through edge cases the first fix didn’t anticipate.
SalesBleed vs. ForcedLeak, Side by Side
| Detail | ForcedLeak (2025) | SalesBleed (2026) |
|---|---|---|
| Researcher | Noma Security (Sasi Levi) | Zenity Labs (Alex Apostolov, João Donato, others) |
| Entry point | Web-to-Lead Description field | Web-to-Lead form fields |
| Exfiltration path | Expired allowlisted domain, resold for ~$5 | DNS query via HTML image tag to attacker domain |
| Bypassed control | Lack of a Trusted URLs mechanism | Trusted URLs mechanism’s TLD and parsing gaps |
| CVSS score | 9.4 | Not assigned (no CVE issued) |
| Reported to Salesforce | July 28, 2025 | June 1, 2026 |
| Fix confirmed | September 8, 2025 | August 19, 2026 |
| Public disclosure | September 25, 2025 | September 24, 2026 |
| Extra attack surface | CRM data only | Adds Slack-based phishing via agent identity hijack |
Why Agent Security Keeps Breaking the Same Way
The reason ForcedLeak and SalesBleed rhyme so closely is architectural, not incidental. Large language models process a system prompt, a user’s request, and any external text they retrieve, such as a CRM lead field, as one continuous stream of tokens. There is no reliable mechanical way for the model to mark some of those tokens as trusted instructions and others as untrusted data. A hostile sentence hidden in a web form carries exactly the same authority, from the model’s perspective, as an instruction typed by an employee. Researcher Simon Willison has described the underlying risk pattern as the “lethal trifecta”: an agent that can read private data, get exposed to untrusted content, and communicate externally all at once has, by definition, the ingredients for exfiltration, regardless of which specific bug a red team eventually finds.
The OWASP GenAI Security Project’s June 2026 State of Agentic AI Security and Governance report found that prompt injection now maps to six of the ten categories in its Top 10 for Agentic Applications, making it the connective tissue behind most agent-related incidents rather than one bug type among many. The same report notes that shadow AI, agents deployed without security review, sits inside nearly every organization its contributors examined, and that only 37% of organizations have a policy in place to even detect it, based on IBM data cited in the report.
SalesBleed Fits a Much Bigger 2025-2026 Pattern
Salesforce’s CRM agents are far from the only ones under pressure. The OWASP report documents a string of comparable incidents across the coding-agent ecosystem this site has tracked separately, including how the GitSpawn flaw hit seven AI coding agents and how Plugin4Shell bypassed SHA-pinning protections in four more. In March 2026, attackers compromised the LiteLLM package, the gateway many agent frameworks use to talk to language models, through a hijacked Trivy GitHub Actions token, and pushed backdoored versions to PyPI that racked up roughly 47,000 downloads in a three-hour window before anyone caught it, per OWASP’s tracking. Separately, a remote-code-execution flaw in core MCP infrastructure, CVE-2025-6514, scored 9.6 on the CVSS scale, and a Cursor vulnerability tracked as CVE-2026-22708 let attackers poison an agent’s execution environment so its own allowlisted commands delivered arbitrary payloads.
| Incident | Layer affected | Severity / scale |
|---|---|---|
| ForcedLeak (Salesforce Agentforce, 2025) | SaaS CRM agent | CVSS 9.4 |
| SalesBleed (Salesforce Agentforce, 2026) | SaaS CRM agent + Slack integration | 3 flaws, no CVE issued |
| postmark-mcp backdoor (CVE-2025-6514) | MCP protocol infrastructure | CVSS 9.6, RCE |
| Cursor allowlist bypass (CVE-2026-22708) | Coding agent execution environment | Turns allowlisted commands malicious |
| LiteLLM PyPI backdoor (“hackerbot-claw”) | Package / supply chain | ~47,000 downloads in a 3-hour window |
Zenity’s own count of the enterprise landscape adds useful context: Agentforce is one deployment among dozens most large organizations now run, and this outlet has previously covered how compromised AI agents have already been used to steal payment card data at scale, how Amazon blocked a rival’s AI agent over trust concerns of its own, and how a maximum-severity flaw in Azure AI Foundry needed no customer action at all because Microsoft controlled the fix end to end, the same managed-service pattern now playing out with Salesforce.
Market and Governance Impact
No CVE, no confirmed customer breach, and a vendor that closed the loop within roughly eleven weeks add up to a story that will not move Salesforce’s stock. But it lands squarely inside a much bigger governance fight enterprises are already having over agentic AI. Cyber-incident reporting clocks are tightening worldwide at the same time agent deployments are multiplying, which raises the stakes for exactly this kind of vulnerability the next time a fix doesn’t fully close the gap.
| Regulation | Jurisdiction | Incident notification window |
|---|---|---|
| DORA | European Union (financial sector) | 4 hours for major incidents |
| NIS2 Directive | European Union | 24 hours early warning |
| RAISE Act | New York State | 72 hours for frontier-model incidents |
| SB 53 | California | 15 days |
The OWASP GenAI Security Project’s report tracks 42 distinct regulatory instruments across 10 jurisdictions now touching AI incident response in some form. For a company running Agentforce with CRM and Slack integrations enabled, that means a bug like SalesBleed, had it been actively exploited, could have triggered notification obligations under several of those regimes simultaneously, depending on what data left the building and where the affected customers are based. Cyber insurers are watching the same trend line: a vulnerability class that keeps reappearing in the same product a year apart is exactly the kind of repeat-pattern risk underwriters price into premiums.
How SalesBleed Compares to Other Agent Platforms’ Defenses
Salesforce is not unique in leaning on an output-redaction layer as its primary defense against prompt-injection-driven exfiltration, and it is not unique in having that layer bypassed. Microsoft’s Copilot Studio and Google’s Vertex AI Agent Builder both publish comparable allowlisting and content-filtering controls for agent output, and both have faced their own bypass research over the past year. The common thread across every case this outlet has tracked, including the anatomy of the Hugging Face agent intrusion, is that a single redaction or allowlist layer sitting between an autonomous agent and the outside world tends to fail eventually, because it must correctly classify every possible malicious variant in advance rather than constraining what the agent can do in the first place.
That is why Meta’s “Agents Rule of Two” framework, cited in OWASP’s 2026 report, has gained traction as an alternative design principle: an agent operating without a human in the loop should be allowed to combine at most two of three risky properties, access to private data, exposure to untrusted content, or the ability to communicate externally. Agentforce’s General CRM subagent, by design, combines all three. So did the Slack Knowledge subagent before Salesforce added attribution requirements. Fixing the redaction filter closes one path. It does not remove the underlying combination that made the exploit possible in the first place.
What Security Teams Running Agentforce Should Do Now
Salesforce has already shipped fixes for all three SalesBleed issues, so there is no outstanding patch to apply. The practical work for security teams is auditing configuration, not chasing a CVE. That starts with reviewing which subagents are enabled by default, particularly Web-to-Lead-connected CRM subagents and any Slack-facing template, and confirming that write actions still require explicit user confirmation rather than the streamlined defaults some teams enable for convenience.
- Audit every public-facing lead or web form that feeds data an Agentforce agent can later read.
- Confirm Trusted URLs enforcement is active organization-wide, not just for the subagents flagged in Zenity’s research.
- Require confirmation prompts on any Slack, email, or messaging action an agent can trigger on a user’s behalf.
- Log which subagents and tools each Agentforce deployment has access to, since visibility gaps are what let flaws like this go unnoticed for months.
- Treat any AI agent that reads external content and can act autonomously as a candidate for the same scrutiny given to a public-facing API.
Illustrating the Attack Pattern
Zenity’s published research describes the exfiltration mechanism at a conceptual level, useful for defenders trying to recognize the pattern rather than as exploit code. The core idea: a benign-looking request causes an agent to render a link whose hostname secretly encodes stolen data.
1. Attacker submits a Web-to-Lead form with a hidden instruction in a text field.
2. Employee asks the agent to review recent leads (a normal, benign request).
3. Agent reads the poisoned lead and follows the hidden instruction instead.
4. Agent queries CRM records, encodes values into a subdomain string.
5. Agent renders that string inside an HTML image tag in its reply.
6. The rendering client fetches the image, generating a DNS/HTTPS
request that carries the stolen values to the attacker's server.Historical Context: From Chatbots to Autonomous CRM Agents
Two years ago, the worst-case outcome of a compromised enterprise chatbot was usually reputational: an embarrassing screenshot of a bot saying something inappropriate. Agentforce, Copilot Studio, and comparable platforms changed that calculus by giving agents write access to CRM records, calendars, ticketing systems, and messaging platforms, and by letting them act without a human approving every step. ForcedLeak and SalesBleed sit at the exact point where that shift becomes measurable: both attacks required zero credentials and zero clicks, relying entirely on data an agent was already trusted to read. That is a fundamentally different risk profile than the phishing and credential-stuffing attacks that dominated enterprise security discussions before agentic AI reached this scale of deployment.
Predictions: Where This Goes Next
Based on the pattern established by ForcedLeak and SalesBleed, and the broader trend OWASP’s 2026 report documents, a few developments look likely over the next year.
- More researchers will target the specific combination of public web forms and CRM-connected agents across other SaaS platforms, not just Salesforce, since the pattern is now public and well understood.
- Vendors will move away from single-layer output redaction toward permission models closer to Meta’s “Agents Rule of Two,” restricting which capability combinations an agent can hold without human sign-off.
- Expect at least one more disclosure in this exact product line within twelve months, given that the same Web-to-Lead entry point has now been the root cause of two separate vulnerability chains a year apart.
- Regulators will increasingly treat agent-specific incidents as a distinct reporting category, following the lead of instruments like the RAISE Act and SB 53, rather than folding them into generic data-breach rules.
- Enterprise buyers will start asking AI agent vendors for red-team results on prompt injection specifically, the way they already ask for SOC 2 reports, before approving new agent deployments.
Frequently Asked Questions
What is SalesBleed?
SalesBleed is the name Zenity Labs gave to three vulnerabilities in Salesforce Agentforce, disclosed September 24, 2026, that could let an attacker submit a poisoned lead through a public Web-to-Lead form and later trick an Agentforce agent into leaking CRM data or sending phishing messages, all without the victim clicking anything.
Was SalesBleed assigned a CVE number?
No. Salesforce treats Agentforce as a hosted service it patches directly, so vulnerabilities in it typically don’t receive CVE identifiers, unlike flaws in software customers install and patch themselves.
Has Salesforce fixed the SalesBleed vulnerabilities?
Yes. Salesforce confirmed the Trusted URLs hardening was complete by August 18, 2026, and Zenity Labs verified the fix on August 19, 2026, over a month before the public disclosure.
Is SalesBleed related to the ForcedLeak vulnerability from 2025?
They are separate vulnerability chains found by different research teams, but both exploited the same Web-to-Lead entry point in Salesforce Agentforce and both targeted the Trusted URLs mechanism Salesforce uses to stop agents from leaking data to untrusted destinations.
Were any customer records actually stolen?
Salesforce has said it found no evidence that either SalesBleed or ForcedLeak was exploited against real customers before the respective patches shipped. Both were identified and reported by independent research teams, not discovered through an active breach.
What should companies using Agentforce do right now?
Since the fixes are already live, the priority is auditing configuration: confirm Trusted URLs enforcement is active, review which subagents are enabled by default, and require confirmation prompts on any action an agent can take involving Slack, email, or CRM writes.
Does this affect other AI agent platforms besides Salesforce?
The specific bugs are Salesforce-specific, but the underlying weakness, an output-redaction layer that can’t recognize every untrusted destination in advance, is common to most enterprise agent platforms, including Microsoft Copilot Studio and Google’s Vertex AI Agent Builder, both of which have faced comparable bypass research.
