SalesBleed Turns Salesforce Agentforce Leads Into Data Leaks and Phishing

Key Takeaways

• Zenity Labs disclosed three Salesforce Agentforce flaws, dubbed SalesBleed, on September 24, 2026.
• Hidden instructions submitted through a public Web-to-Lead form lay dormant until an employee asked Agentforce about leads.
• The hijacked agent could read Account data and send it out, or post phishing messages in Slack under its own identity.
• Salesforce fixed all three issues by August 19, and no exploitation has been reported.

One Web Form, One Hijacked Sales Agent

Researchers at Zenity Labs found that a single public lead form could hijack Salesforce Agentforce. As Dark Reading reported, the flaws could leak CRM data and let attackers phish employees from inside trusted Slack channels.

What We Know

Zenity Labs reported the three SalesBleed issues to Salesforce on June 1, 2026. According to The420, Salesforce confirmed all three were fixed by August 19.

Zenity published its research on September 24. The entry point was Web-to-Lead, the Salesforce feature that turns website form submissions into lead records automatically.

No exploitation in the wild has been reported, and no CVEs were assigned.

What Could Happen

An attacker fills in a public Web-to-Lead form with hidden instructions meant for the AI agent. Nothing happens until an employee asks Agentforce an ordinary question, such as reviewing new leads.

When the agent reads the poisoned record, it treats the text as instructions. In Zenity's test, the agent's CRM permissions reached Account data the attacker could never see directly, and that data could be sent to an outside server.

A second path abused the Slack integration. The reply action needed no confirmation and did not show which user triggered it, so the agent could post phishing messages under its own trusted name.

Why It Matters

SalesBleed shows that any field an outsider can write to becomes an instruction channel once an agent reads it. No login, stolen password, or malware was needed.

The data at risk, customer accounts and deal details, is among a company's most sensitive. Phishing that arrives from a trusted internal bot is also far more convincing than email.

For governance, agents need least-privilege access scoped to their task, a principle reflected in the NIST AI RMF and the OWASP Top 10 for Agentic Applications.

PointGuard AI Perspective

SalesBleed is an indirect prompt injection that rode on legitimate agent permissions. PointGuard AI addresses both parts.

PointGuard AI runtime guardrails scan retrieved content, records, and tool outputs for injection patterns before they reach the model. Untrusted content, such as a public form submission, is treated as untrusted by default and can be blocked, sanitized, or sent for review.

AI data protection adds AI-native data leak detection across prompts, responses, and tool calls, so account data does not leave through an agent's output.

With Agent Identity and Access Security, intent-based access control limits each agent to the tools and operations its task needs. High-impact actions, like posting to shared channels, can route through approval.

Trustworthy agent adoption means assuming every external input may carry instructions, and building controls that hold even when it does.

Incident Scorecard Details

Total AISSI Score: 5.85/10

Criticality: 8, CRM account data and trusted internal Slack channels were reachable. AISSI weighting: 25%

Propagation: 6, One poisoned lead could affect any agent workflow that reads it. AISSI weighting: 20%

Exploitability: 4, Detailed research demonstrations, with no observed exploitation. AISSI weighting: 15%

Supply Chain: 7, Risk sat in a hosted third-party agent platform and its integrations. AISSI weighting: 15%

Business Impact: 4, Fixed before disclosure with no reported customer harm. AISSI weighting: 25%

Sources

Third-Party Sources

• Dark Reading: 'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing
• The420: Salesforce Agentforce Flaws Enabled Zero-Click CRM Data Theft and Phishing

PointGuard AI Sources

• PointGuard AI Runtime Guardrails
• PointGuard AI Data Protection
• PointGuard AI Agent Identity and Access Security