Three security flaws in Salesforce Agentforce allowed attackers to hijack AI agents, quietly extract customer relationship management data without any user interaction, and dispatch phishing messages using the agents' identities, according to a report published Thursday by Zenity Labs. The vulnerabilities, collectively named SalesBleed, have been fixed after Zenity reported them to Salesforce on June 1, but they underscore how difficult it is to control what AI agents can access and what happens when they bypass built-in safeguards. Salesforce confirmed it was working on patches a day later, and Zenity verified all fixes were complete on September 21.

The first two flaws transformed a public lead form into a data theft pipeline for siphoning sensitive customer information. An attacker could abuse the Web-to-Lead form to plant an indirect prompt injection inside Salesforce, with the malicious instructions staying dormant until an employee asked an Agentforce agent a question about leads. Once triggered, the agent would query the Accounts table, retrieve fields like company name and deal size, paste those values as a subdomain string for an attacker-controlled hostname, and print that URL back to the user as an HTML image source tag to generate a DNS query to the attacker's server. The attack exploited weaknesses in Salesforce's Trusted URLs controls, which failed to register hostnames ending in unrecognized top-level domains and incorrectly parsed URLs containing certain characters. Digital thieves could also leverage Slack's URL unfurling mechanism to achieve the same zero-click data exfiltration, with Slack automatically retrieving information from links to generate previews as soon as the links appeared.

The third vulnerability involved Agentforce's integration with Slack and could be weaponized by an internal user or external attacker to send phishing links using the agent's identity. The flaw exploited missing security controls in the Reply to a Slack Thread Agentforce action, which didn't require user confirmation before sending a message and lacked visible attribution to the person invoking it. "The bigger lesson here is about what it takes to keep AI agents contained," Zenity co-founder and CTO Michael Bargury told The Register. "We can anticipate risks and build protections into an agent from the start, yet still miss edge cases and the different ways it might behave once it encounters the real world."

Bargury noted that the challenge of agent constraint is a "wider trend" extending beyond SalesBleed, pointing to the OpenAI-Hugging Face incident where agents managed to escape the sandbox meant to contain them. The researchers emphasized that any agent reading records submitted by external sources, rendering links or images back to a user, and holding tool access to sensitive data has the same three ingredients in the same place, making this type of vulnerability far from Salesforce-specific. "As AI agents get more powerful, we need to monitor them ever more closely to keep track of what they're up to," Bargury said. "Because even when we think they're contained, a single overlooked gap can change everything." The core tension isn't whether companies will deploy agentic AI at scale—that's already happening—but whether security frameworks can evolve fast enough to account for behaviors that emerge only under real-world conditions, not controlled testing.