Zenity Discloses SalesBleed Flaws in Salesforce Agentforce

Zenity Labs says it found three flaws in Salesforce Agentforce that let attackers steal CRM data with no clicks required, using nothing more than a poisoned Web-to-Lead form. SecurityWeek reports that the researchers, who branded the chain SalesBleed, disclosed the vulnerabilities to Salesforce on June 1, 2026, and Salesforce shipped fixes for all three by August 19.

The mechanic is what makes it striking. "Malicious instructions injected into a Web-to-Lead lead would remain dormant until an employee asks an Agentforce agent to interact with the submission," Zenity Labs wrote. Once the agent processed the poisoned lead, the hidden prompt ran inside a trusted context and exfiltrated data via HTML image tags, bypassing the Trusted URLs allowlist that is supposed to lock outbound calls to approved domains. According to the write-up, "Zenity Labs discovered that the mechanism did not recognize top-level domains and that character sequences could tamper with URL parsing."

A second path abused Slack's link previews: "Specially constructed links can cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear." A third turned the agent into a phishing beachhead inside internal Slack channels, delivering messages that read as coming from a trusted system operating inside the workplace rather than an unfamiliar outside sender.

One detail in the disclosure should worry SOC teams more than the bugs themselves: "Agentforce reported that the content had been blocked by the organization's security policies, even though the sensitive CRM data had already been transmitted to the attacker-controlled server." No CVEs were assigned. It lands the same week as OpenAI's DNS-exfiltration disclosure, another entry in a growing pattern across our agents coverage where the tool-use surface, not the model, is where the incident lives.