SalesBleed: Salesforce Agentforce vulnerabilities enable zero-click CRM data theft and trusted-agent Slack phishing

SalesBleed: Salesforce Agentforce vulnerabilities enable (TL-2026-2642), also tracked as SalesBleed, is a high-severity software vulnerability, first published 2026-09-24. It has no confirmed attribution, affects Salesforce Agentforce, maps to 13 MITRE ATT&CK / ATLAS techniques (AML.T0010, AML.T0043, AML.T0051), and is covered by 9 detection rules and 5 indicators of compromise.

Key facts for TL-2026-2642

Threat ID
TL-2026-2642
Also known as
SalesBleed, ForcedLeak, Prompt Mines
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-24
Last reviewed
2026-09-24
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
finance, health, retail, technology, telecoms, manufacturing
Target regions
Global
Detection rules
9
Indicators of compromise
5

Malware and tooling in SalesBleed: Salesforce Agentforce vulnerabilities enable

Malware and tooling: Gozi

Zenity Labs disclosed SalesBleed, a set of three vulnerabilities in Salesforce Agentforce that let an untrusted lead hijack trusted AI agents. Attackers can silently exfiltrate CRM data (zero-click) via Web-to-Lead indirect prompt injection and Trusted URLs bypasses, and impersonate the agent to phish employees from within trusted internal Slack channels via the 'Reply to a Slack Thread' action. Salesforce acknowledged the flaws (no CVE numbers assigned), found no evidence of real-world exploitation, and shipped fixes; all three were verified fixed by September 21, 2026.

How SalesBleed: Salesforce Agentforce vulnerabilities enable works

SalesBleed is a set of three related security vulnerabilities in Salesforce Agentforce, an AI-agent platform that embeds into the Salesforce CRM (and Einstein AI), disclosed by Zenity Labs on September 24, 2026. The flaws share a root cause in how Agentforce governs and sanitizes external URLs and how it handles instructions carried in untrusted data. They allow an attacker with only the ability to submit a public Web-to-Lead form to plant a dormant indirect prompt injection inside the CRM, which later detonates when an employee legitimately asks an Agentforce agent about leads or records.

The first vulnerability is zero-click CRM data exfiltration through a Trusted URLs bypass. Salesforce's Trusted URLs control is meant to restrict which external destinations Agentforce agents may access and to redact links/images that point to untrusted URLs. Zenity found the regex-based redaction failed to register hostnames ending in unrecognized top-level domains, and that certain characters interfered with how URLs were parsed, letting crafted URLs evade redaction. Using this, an attacker's injected instructions cause the agent to query the Accounts table (via the subagent's Query Records tool), take stolen fields (company name, deal size, email addresses), embed them as a subdomain string for an attacker-controlled hostname, and print the result as an HTML <img src> tag. When the frontend renders it, the browser or agent infrastructure makes a DNS query / HTTP request to the attacker's server, silently exfiltrating the data with no click from the victim. A related second zero-click variant abuses Slack's URL unfurling: specially constructed links cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear in a channel.

The third vulnerability is trusted-agent impersonation for phishing. The Agentforce-Slack integration's 'Reply to a Slack Thread' action did not require user confirmation and did not surface attribution, so an agent (hijacked via indirect prompt injection, or driven by an insider) could post phishing messages under the trusted agent's identity from within internal Slack channels, with the sender remaining effectively anonymous. Salesforce subsequently updated default settings so certain Agentforce actions in Slack require user confirmation.

The findings build on earlier related research on the same platform. Noma Security's ForcedLeak (disclosed September 2025, CVSS-equivalent 9.4) demonstrated a nearly identical Web-to-Lead indirect prompt injection against Agentforce that exfiltrated CRM data by exploiting a Salesforce Content Security Policy that whitelisted *.my-salesforce-cms.com - a domain that had expired and become purchasable - turning it into a 'trusted' exfiltration channel. Salesforce responded by enforcing Trusted URL allowlisting for Agentforce and Einstein AI on September 8, 2025, the very control SalesBleed later found ways to bypass. Zenity also demonstrated related 'Prompt Mines' 0-click indirect prompt injections against Salesforce Einstein (shown at Black Hat 2025).

Salesforce acknowledged the flaws and responsibly shipped fixes: the Trusted URLs bypass was fixed (confirmed August 19, 2026) and all three flaws were confirmed fixed by September 21, 2026. No CVE numbers were assigned and no evidence of real-world exploitation had been observed at reporting time. The research community notes this class of AI-agent prompt-injection and URL-governance weakness is not Salesforce-specific and may recur across other AI agent platforms, so defenders should treat agents as production components, enforce least-privilege URL allowlists, monitor for anomalous outbound image/DNS requests, and require human confirmation for agent-initiated external actions.

MITRE ATT&CK / ATLAS techniques used in TL-2026-2642

initial-access

AML.T0010 AI Supply Chain Compromise

AI Attack Staging

AML.T0043 Craft Adversarial Data

execution

AML.T0051 LLM Prompt Injection

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Command and Control

T1071 Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application; T1566 Phishing

Execution

T1204 User Execution

Collection

T1213 Data from Information Repositories

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure

Defense Evasion

T1684.001 Impersonation

Affected products and versions in SalesBleed: Salesforce Agentforce vulnerabilities enable

  • Salesforce — Agentforce
    Vulnerable versions: pre-Trusted-URLs-enforcement and pre-Sept-2026-patch builds
    Fixed in: Trusted URLs Enforcement (2025-09-08) and SalesBleed fixes confirmed 2026-09-21
  • Salesforce — Einstein AI / Einstein Generative AI
    Vulnerable versions: builds before Trusted URL allowlisting enforcement
    Fixed in: Trusted URL allowlisting enforcement (2025-09-08)

Remediation for SalesBleed: Salesforce Agentforce vulnerabilities enable

Patches

  • Apply Salesforce Trusted URLs Enforcement and the updated default settings for Agentforce Slack actions (all three SalesBleed flaws verified fixed by 2026-09-21)

Immediate actions

  • Enable and verify Trusted URL allowlists for Agentforce and Einstein AI, adding all external domains agents legitimately call
  • Review and tighten Content-Security-Policy directives (especially img-src and connect-src) for agent-generated content
  • Audit existing lead/case/account data for suspicious Web-to-Lead and Web-to-Case submissions carrying injected instructions
  • Enable user confirmation for Agentforce-to-Slack actions such as 'Reply to a Slack Thread'

Workarounds

  • Restrict Web-to-Lead field lengths to reduce injection payload capacity
  • Disable or restrict unused agent-to-Slack and image-generation actions
  • Monitor for outbound requests to unrecognized TLDs / suspicious hostnames from Salesforce and Slack infrastructure

Longer-term hardening

  • Deploy prompt-injection detection and input validation on user-controlled CRM fields (Web-to-Lead, Email-to-Case, Web-to-Case)
  • Treat AI agents as production components: maintain an AI agent inventory/BOM and threat-model agent tool-calling
  • Add runtime tool-calling and exfiltration guardrails (anomalous outbound DNS/image/HTTP from agent infrastructure)
  • Apply least-privilege data access to agents so they cannot query records outside their required scope

Weaknesses (CWE) in SalesBleed: Salesforce Agentforce vulnerabilities enable

CWE-74, CWE-20, CWE-918

Timeline of SalesBleed: Salesforce Agentforce vulnerabilities enable

  • Noma Security reports the ForcedLeak indirect prompt injection chain in Salesforce Agentforce (related prior disclosure on the same platform).
  • Salesforce enforces Trusted URL allowlisting for Agentforce and Einstein Generative AI in response to ForcedLeak - the control SalesBleed later bypasses.
  • Zenity Labs responsibly discloses SalesBleed (three Salesforce Agentforce flaws) to Salesforce.
  • Salesforce confirms the Trusted URLs bypass vulnerability is fixed.
  • Salesforce confirms all three SalesBleed flaws are fixed; no evidence of real-world exploitation reported.
  • TL-Intel harness creates this threat record for defender awareness and Slack/Agentforce phishing detection.
  • Zenity Labs publicly discloses SalesBleed; Dark Reading and The Register report; Salesforce updates default settings so certain Agentforce actions in Slack require user confirmation.

Sources cited for SalesBleed: Salesforce Agentforce vulnerabilities enable

More in vulnerability

Detection coverage for TL-2026-2642

As of 2026-09-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2642 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats