Salesforce fixed three Agentforce vulnerabilities that let attackers abuse public Web-to-Lead forms to make AI agents quietly steal customer relationship management data and send phishing messages under the agent’s identity. Zenity called the chain "SalesBleed" and said the attacks used indirect prompt injection embedded in lead records, then bypassed Agentforce Trusted URLs protections to exfiltrate data through DNS requests and support anonymous phishing; no CVEs are cited in the article.
Why it matters: Organizations using Salesforce Agentforce could have had sensitive sales and customer data exposed without staff realizing it, simply by having an agent process a poisoned lead. Users should review Salesforce’s fixes and hardening guidance immediately, audit Agentforce use of Web-to-Lead and external destinations, and watch for suspicious outbound messaging or data access.
Ionut Arghire
2026.09.25
98% relevant
This is the same underlying Agentforce 'SalesBleed' event and adds technical detail on the three flaws, including abuse of Web-to-Lead submissions, Trusted URLs parsing weaknesses, zero-click exfiltration via HTML image tags and Slack link previews, and Salesforce's timeline for fixing the issues by August 19.
2026.09.24
100% relevant
This article appears to be the initial report on the specific Agentforce "SalesBleed" flaw set and establishes the underlying event: patched Salesforce AI agent vulnerabilities enabling zero-click data exfiltration and phishing.
← Back to all stories