# SalesBleed: Salesforce Agentforce vulnerabilities enable zero-click CRM data theft and trusted-agent Slack phishing

> Zenity Labs disclosed SalesBleed, a set of three vulnerabilities in Salesforce Agentforce that let an untrusted lead hijack trusted AI agents. Attackers can silently exfiltrate CRM data (zero-click) via Web-to-Lead indirect prompt injection and Trusted URLs bypasses, and impersonate the agent to phish employees from within trusted internal Slack channels via the 'Reply to a Slack Thread' action. Salesforce acknowledged the flaws (no CVE numbers assigned), found no evidence of real-world exploitation, and shipped fixes; all three were verified fixed by September 21, 2026.

- **Published:** 2026-09-24T00:00:00Z
- **Last reviewed:** 2026-09-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2642
- **ID:** TL-2026-2642
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SalesBleed is a set of three related security vulnerabilities in Salesforce Agentforce, an AI-agent platform that embeds into the Salesforce CRM (and Einstein AI), disclosed by Zenity Labs on September 24, 2026. The flaws share a root cause in how Agentforce governs and sanitizes external URLs and how it handles instructions carried in untrusted data. They allow an attacker with only the ability to submit a public Web-to-Lead form to plant a dormant indirect prompt injection inside the CRM, which later detonates when an employee legitimately asks an Agentforce agent about leads or records.

The first vulnerability is zero-click CRM data exfiltration through a Trusted URLs bypass. Salesforce's Trusted URLs control is meant to restrict which external destinations Agentforce agents may access and to redact links/images that point to untrusted URLs. Zenity found the regex-based redaction failed to register hostnames ending in unrecognized top-level domains, and that certain characters interfered with how URLs were parsed, letting crafted URLs evade redaction. Using this, an attacker's injected instructions cause the agent to query the Accounts table (via the subagent's Query Records tool), take stolen fields (company name, deal size, email addresses), embed them as a subdomain string for an attacker-controlled hostname, and print the result as an HTML <img src> tag. When the frontend renders it, the browser or agent infrastructure makes a DNS query / HTTP request to the attacker's server, silently exfiltrating the data with no click from the victim. A related second zero-click variant abuses Slack's URL unfurling: specially constructed links cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear in a channel.

The third vulnerability is trusted-agent impersonation for phishing. The Agentforce-Slack integration's 'Reply to a Slack Thread' action did not require user confirmation and did not surface attribution, so an agent (hijacked via indirect prompt injection, or driven by an insider) could post phishing messages under the trusted agent's identity from within internal Slack channels, with the sender remaining effectively anonymous. Salesforce subsequently updated default settings so certain Agentforce actions in Slack require user confirmation.

The findings build on earlier related research on the same platform. Noma Security's ForcedLeak (disclosed September 2025, CVSS-equivalent 9.4) demonstrated a nearly identical Web-to-Lead indirect prompt injection against Agentforce that exfiltrated CRM data by exploiting a Salesforce Content Security Policy that whitelisted *.my-salesforce-cms.com - a domain that had expired and become purchasable - turning it into a 'trusted' exfiltration channel. Salesforce responded by enforcing Trusted URL allowlisting for Agentforce and Einstein AI on September 8, 2025, the very control SalesBleed later found ways to bypass. Zenity also demonstrated related 'Prompt Mines' 0-click indirect prompt injections against Salesforce Einstein (shown at Black Hat 2025).

Salesforce acknowledged the flaws and responsibly shipped fixes: the Trusted URLs bypass was fixed (confirmed August 19, 2026) and all three flaws were confirmed fixed by September 21, 2026. No CVE numbers were assigned and no evidence of real-world exploitation had been observed at reporting time. The research community notes this class of AI-agent prompt-injection and URL-governance weakness is not Salesforce-specific and may recur across other AI agent platforms, so defenders should treat agents as production components, enforce least-privilege URL allowlists, monitor for anomalous outbound image/DNS requests, and require human confirmation for agent-initiated external actions.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1204 User Execution
- T1684.001 Impersonation
- T1213 Data from Information Repositories
- T1048 Exfiltration Over Alternative Protocol
- T1567 Exfiltration Over Web Service
- T1071 Application Layer Protocol
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- AML.T0051 LLM Prompt Injection
- AML.T0043 Craft Adversarial Data
- AML.T0010 AI Supply Chain Compromise

## Sources

- [Dark Reading: 'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing](https://www.darkreading.com/application-security/salesbleed-exploits-salesforce-agents-slack-phishing)
- [The Register: Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing](https://www.theregister.com/security/2026/09/24/salesforce-agentforce-vulns-allowed-0-click-crm-data-theft-anonymous-phishing/)
- [Zenity Labs: 0Click Attacks: When TTPs Resurface Across Platforms](https://zenity.io/blog/security/zero-click-attacks-when-ttps-resurface-across-platforms)
- [Zenity Labs: Prompt Mines - 0-Click Data Corruption In Salesforce Einstein](https://labs.zenity.io/post/prompt-mines-0-click-data-corruption-in-salesforce-einstein-1cfb)
- [Noma Security: ForcedLeak - Agent risks exposed in Salesforce Agentforce](https://www.noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce)
- [BusinessWire / FinancialContent: Zenity Labs Uncovers SalesBleed, 3 Salesforce Agentforce Flaws](https://www.financialcontent.com/)
- [VMblog: Zenity Labs Uncovers SalesBleed - 3 Salesforce Agentforce Flaws Enabling Zero-Click CRM Data Theft and AI Agent Impersonation](https://www.vmblog.com/news/zenity-labs-uncovers-salesbleed-3-salesforce-agentforce-flaws-enabling-zero-click-crm-data-theft-and-ai-agent-impersonation/)
- [Salesforce Help: Changes to Default Allowlist for Agentforce](https://help.salesforce.com/s/articleView?id=005135034&language=en_US&type=1)
- [Salesforce Release Notes: Secure Your Agents with Trusted URL Allowlisting](https://help.salesforce.com/s/articleView?id=release-notes.rn_einstein_agentforce_urls.htm&language=en_US&release=258&type=5)
- [GovInfoSecurity: Salesforce Patches CRM Data Exfiltration Vulnerability](https://www.govinfosecurity.com/salesforce-patches-crm-data-exfiltration-vulnerability-a-29578)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2642