Researchers at Zenity Labs uncovered critical vulnerabilities in Salesforce Agentforce, dubbed SalesBleed, on September 24, 2026. The flaws allowed attackers to plant malicious instructions in public Web-to-Lead forms, which AI agents then processed to exfiltrate sensitive data. One variant exploited Slack's link unfurling, while two bypassed Salesforce's Trusted URLs control, enabling zero-click data exfiltration. The most concerning finding involved Agentforce's Slack integration, where an attacker could post phishing messages under the agent's trusted identity without user confirmation or visible attribution.
Salesforce addressed the issues after Zenity reported them on June 1, 2026. The URL-filtering fix was verified on August 19, the Slack attribution fix on August 20, and the default user confirmation requirement on September 21. Salesforce stated it had seen no evidence of exploitation. However, the recurrence of similar vulnerabilities, such as ForcedLeak disclosed by Noma Security in September 2025, highlights a broader pattern in AI agent security.
The OWASP Top 10 for LLM Applications (2025 edition) underscores the risks of prompt injection and excessive agency. It emphasizes that untrusted inputs can influence an agent's actions, necessitating stricter authorization controls in downstream systems. The Slack finding further reveals gaps in identity visibility, as agents can act without traceable attribution, complicating incident response.
Experts recommend inventorying agents exposed to untrusted content and applying existing identity disciplines to these new principals. Organizations should segregate and clearly mark untrusted content, enforce authorization in downstream systems, and ensure every agent action is traceable to a human requester. While Salesforce's fixes address the reported attack chains, the underlying risks persist for any agent processing externally submitted records with access to sensitive data.