Three Salesforce Agentforce vulnerabilities, dubbed “SalesBleed”, enabled attackers to poison public lead forms, hijack AI agents and steal CRM data without an employee clicking anything. The flaws also allowed phishing messages to be sent under an agent’s identity, highlighting the difficulty of containing increasingly capable AI systems and enforcing their security guardrails.

The attacks used indirect prompt injection in Web-to-Lead submissions, triggered when an employee asked Agentforce about leads. Weaknesses in Trusted URLs and URL parsing let stolen account details be embedded in image requests to attacker-controlled servers, including through Slack’s automatic link unfurling; Salesforce and Zenity Labs have since fixed the attack chains.