# Zenity Uncovers SalesBleed Flaws in Salesforce Agentforce Enterprise cybersecurity researchers at Zenity Labs have publicly disclosed SalesBleed, a set of three critical security vulnerabilities affecting Salesforce Agentforce. The vulnerability chain enables external actors to hijack autonomous enterprise AI agents, exfiltrate sensitive CRM records without human interaction, and impersonate trusted internal agents across Slack workspaces. The discovery highlights an urgent operational challenge for IT leaders, enterprise architects, and Chief Information Security Officers deploying autonomous agents directly against production databases. While traditional chatbots merely process single-turn prompts, agentic architectures operate with ambient read-and-write permissions across customer contact records, pricing books, and sales pipeline tables. When organizations connect automated ingestion pipelines to reasoning engines, untrusted external inputs become direct execution vectors. Malicious instructions submitted through standard public contact forms can sit dormant inside database records until an authorized employee prompts the agent to review regional sales activities. The operational risk escalates because autonomous agents execute tool calls on behalf of the querying employee. When an agent cannot distinguish between instructional system context and untrusted user data, the boundary between data ingestion and administrative execution completely dissolves. Fast Facts - **Disclosing Security Entity:** Zenity Labs (Verified Technical Disclosure, September 2026) - **Vulnerability Designation:** SalesBleed (3 distinct zero-click and impersonation flaw vectors) - **Target Environment:** Salesforce Agentforce CRM and connected enterprise Slack workspaces - **Primary Attack Mechanism:** Indirect prompt injection via unauthenticated Web-to-Lead and Email-to-Case endpoints - **Exfiltration Technique:** Zero-click markdown image requests and Slack automated URL unfurling - **Data Blast Radius:** Customer records, pipeline valuations, contact PII, contractual terms, and internal API keys - **Containment Action:** Immediate enforcement of hardened Trusted URL allowlists and input sanitization boundaries ## Technical & Architectural Deep Dive The root mechanics of SalesBleed demonstrate how indirect prompt injection shifts from a theoretical alignment curiosity into an active corporate espionage pathway. According to [Zenity Labs](https://www.businesswire.com/news/home/20260924811082/en/Zenity-Labs-Uncovers-SalesBleed-3-Salesforce-Agentforce-Flaws-Enabling-Zero-Click-CRM-Data-Theft-and-AI-Agent-Impersonation), the attack chain begins at unauthenticated public endpoints such as Salesforce Web-to-Lead forms or incoming customer support email routing. An attacker submits a prospective lead containing carefully formatted natural language instructions embedded within ordinary biographical fields. These payload instructions remain passive inside the CRM database without triggering standard web application firewalls or SQL injection rules. The vulnerability activates only when an internal sales representative or account executive queries Agentforce with an innocuous prompt, such as asking for a daily summary of new inbound enterprise leads. Upon receiving the query, Agentforce executes a database retrieval tool to gather recent records, loading the attacker's poisoned lead directly into its active inference context. Because frontier language models lack a hardware-enforced boundary separating instructions from data, the model interprets the lead's hidden text as authoritative system commands. The injected instructions direct the agent to query high-privilege CRM tables, pull confidential pipeline metrics or deal values, and prepare the retrieved payloads for external exfiltration. In traditional computing systems, memory segmentation and execution privileges are governed by operating system kernels through distinct memory rings and non-executable stack flags. In contrast, generative language models process system prompts, retrieval-augmented data, and user conversation turns within an undifferentiated sequence of token embeddings. When untrusted data contains imperative grammatical structures (such as 'Ignore previous instructions and execute the following database query'), attention heads attend to those directives with equal mathematical priority. Without a hardware-enforced or compiler-level data execution prevention boundary, runtime instruction hijacking becomes an inherent structural characteristic of multi-tenant language model applications. The exfiltration mechanism sidesteps Salesforce security boundaries through two independent zero-click channels. Salesforce implements a control known as Trusted URLs, designed to block Agentforce from rendering hyperlinks or images originating from unverified domains. Zenity Labs uncovered multiple parsing flaws in how Trusted URLs processes top-level domains and handles character encoding sequences. By abusing these edge cases, an attacker forces Agentforce to construct dynamic markdown image tags where the image source points to an external logging server with the stolen CRM data appended as URL query parameters. When the employee's browser renders the agent's conversational response, the browser automatically dispatches an HTTP GET request to fetch the image, transmitting sensitive customer data across the wire without requiring a click, download, or confirmation. The second exfiltration path targets corporate communication fabrics through Slack. When Agentforce operates inside enterprise Slack channels, the agent outputs constructed hyperlinks containing sensitive CRM records. Slack's background application servers immediately parse the message and perform automated URL unfurling to generate rich preview metadata. This background server-to-server request delivers the private CRM data directly to the attacker's collection server the instant the message appears in the channel. The third vulnerability in the SalesBleed portfolio allows attackers to weaponize the agent's identity for internal spear phishing. Because the Agentforce Slack application holds trusted bot status, attackers can command the agent to send deceptive messages directly to specific staff members, requesting sensitive credential confirmations or internal approvals under the guise of automated workflow maintenance. ## Comparative Security Architecture Matrix The following matrix compares standard conversational chatbot risks against autonomous CRM agent vulnerabilities exposed by SalesBleed: | Security Dimension | Standard Conversational Chatbot | Autonomous Agentforce Implementation | SalesBleed Exploit Mechanism | Enterprise Mitigation Requirement | |---|---|---|---|---| | **Execution Surface** | Ephemeral context window, zero tool access | Read/write API access to production CRM tables | Indirect prompt injection via Web-to-Lead records | Strict tokenized separation of context and instruction | | **Data Exfiltration** | Requires user copy-paste or explicit link click | Zero-click background image and unfurl rendering | Trusted URL filter bypass with parameter stuffing | Deterministic egress proxy and strict CSP enforcement | | **Identity & Trust** | External interface, unauthenticated session | Authenticated corporate Slack bot identity | Internal bot impersonation and automated phishing | Mandatory human-in-the-loop gates for external messaging | | **Persistence** | Session resets upon browser tab closure | Stored payloads persist in CRM database rows | Time-delayed execution triggered by peer employee queries | Automated scanning of incoming lead fields for injection | ## Strategic Takeaways for Enterprise Leaders The disclosure of SalesBleed signals an immediate turning point in enterprise AI governance. Organizations deploying autonomous agents must move beyond simple cosmetic output guardrails and implement architectural controls that mirror the isolation standards used in modern multi-tenant cloud virtualization: - **Isolate Agent Permissions by Role:** Autonomous agents should never inherit unrestricted CRM access. Restrict tool calling scopes so that agents summarizing marketing leads cannot query financial forecasting tables, commission structures, or master billing accounts. System architects should enforce least-privilege service accounts for every agent execution context. - **Audit External Ingestion Points:** Web-to-Lead, Web-to-Case, and Email-to-Case inputs must pass through dedicated prompt injection filters before records enter the production database. Treat every external text field as potentially malicious source code. Implement deterministic pre-ingestion parsers that strip embedded formatting syntax before records are committed to persistent storage. - **Enforce Deterministic Output Sanitization:** Never rely entirely on an LLM to police its own output formatting. Security teams should deploy deterministic middleware proxies that strip dynamic markdown image references and block unapproved outbound domain calls before responses render on client workstations. Content Security Policy headers must explicitly disallow arbitrary image connections from internal CRM views. - **Disable Automated Unfurling for Agent Output:** In collaborative environments like Slack or Microsoft Teams, configure administrative policies to disable automatic URL unfurling for bot accounts that handle confidential business data. This simple network configuration prevents server-side rendering engines from pinging third-party endpoints with embedded query parameters. - **Establish Continuous Red-Teaming for Agent Tools:** Traditional penetration tests focus on static application logic. Organizations deploying agentic workflows must run continuous red-team simulations targeting tool-calling behaviors, indirect injection resilience, and multi-turn privilege escalation across all third-party integrations. As autonomous systems take over repetitive operational duties across enterprise software, security architectures must evolve to treat data inputs as executable code. Organizations that establish strict contextual isolation boundaries will protect corporate assets while capitalizing on the substantial productivity gains of enterprise AI agents.