"SalesBleed": One Poisoned Web-to-Lead Form Hijacks Salesforce Agentforce and Its Slack Agent

Salesforce Agentforce agents and the Agentforce integration with Slack

Zenity Labs disclosed SalesBleed on September 24, 2026, three vulnerabilities that let a single untrusted sales lead take over a trusted Agentforce agent. The attacker submits a public Web-to-Lead form carrying hidden instructions, which sit dormant in the CRM until an employee later asks an agent an ordinary question about leads. When the agent processes the poisoned record, the instructions take over. Two of the flaws were bypasses of Agentforce's Trusted URLs allowlist, which failed to handle top-level domains correctly and let crafted character sequences confuse URL parsing, so CRM data could leave through HTML image tags pointing at attacker servers with no click or approval from anyone. The third abused the Slack integration: specially built links make Slack's own link preview fetch carry CRM data to attacker infrastructure the moment they appear, and the agent's trusted identity could be used to post phishing messages to employees from inside the workspace. The agent returns what looks like a normal answer to the employee while this happens. Zenity reported the issues on June 1, 2026; Salesforce fixed the Trusted URLs bypasses within about two weeks and confirmed all three addressed by August 19, 2026

A public, unauthenticated form feeds a record that an agent with CRM read access and outbound channels later treats as instructions. The allowlist meant to stop exfiltration was a URL parser, and the chat platform's link unfurling acted as a second exfiltration path that nobody had put on the list