The Anatomy of SalesBleed
Security researchers at Zenity Labs have unveiled a sophisticated set of vulnerabilities within Salesforce’s Agentforce platform, collectively branded as SalesBleed. These security gaps, which have since been patched, exposed a critical reality of the current AI landscape: the difficulty of maintaining strict access controls when powerful autonomous agents are granted permission to interact with both internal data and external inputs. The vulnerabilities allowed attackers to silently siphon sensitive CRM data and even weaponize the AI agent to distribute phishing links under the guise of an internal system, all without requiring a single interaction from the end user.
The attack chain originated through public-facing Web-to-Lead forms. By injecting malicious, dormant instructions into these forms, attackers could wait for an employee to simply query their leads. Once the Agentforce agent processed the poisoned lead, the hidden commands would execute, forcing the agent to query internal tables and exfiltrate the data by embedding it into outgoing image requests. This 0-click mechanism effectively bypassed standard security perimeters by masquerading stolen information as benign DNS queries or URL fetches that the system deemed trustworthy.
The Breakdown of the Vulnerabilities
The SalesBleed discovery highlights three distinct but related flaws that enabled this breach. The first two vulnerabilities exploited weaknesses in Salesforce’s 'Trusted URLs' controls. By manipulating how the platform parsed URLs and utilizing unrecognized top-level domains, attackers could circumvent the system's redaction mechanisms. This allowed the agent to render malicious HTML tags—specifically img src tags—that were designed to leak data to an attacker-controlled server. Because the frontend rendered these images without further sanitization, the data exfiltration happened entirely in the background.
The third vulnerability involved the platform’s integration with Slack. Researchers discovered that the 'Reply to a Slack Thread' action within Agentforce lacked both mandatory user confirmation and clear attribution. An attacker could exploit this to force an agent to post messages on behalf of the system. Whether by an internal bad actor or an external attacker using a poisoned lead, the agent became a blind conduit for phishing, sending malicious links to unsuspecting employees under the trusted authority of the organization's own AI assistant.
Why it Matters
- Data Leakage: These flaws prove that AI agents can be manipulated into bypassing internal data silos when they have broad read/write tool access.
- Platform Agnosticism: While Salesforce has addressed the specific bugs, researchers warn that the architecture of modern AI agents—which often parse external data and render links—makes this a systemic risk across the industry.
- The Trust Deficit: As companies integrate AI deeper into their workflows, the 'agent identity' becomes a vulnerability. If an agent lacks proper human-in-the-loop verification, it becomes a high-value target for social engineering and phishing campaigns.
The successful mitigation of these flaws by Salesforce—confirmed as of late September—serves as a reminder that 'secure-by-design' principles are being tested in real-time. As agents gain more autonomy, the security community emphasizes that developers must move beyond basic sandboxing. Future security models will likely require stricter, multi-layered validation for every tool invocation, ensuring that even if an agent is tricked by a poisoned input, it cannot translate that deception into unauthorized data movement or unauthorized communication.
