A public, unauthenticated lead-capture form was enough for an attacker to turn a Salesforce agent into an exfiltration channel. Zenity Labs named it SalesBleed, and it’s a textbook case of why agents with CRM access need more than URL filters.
Zenity Labs published SalesBleed, a set of three vulnerabilities in Salesforce Agentforce. The premise: a single malicious lead, submitted through a Web-to-Lead form (which by design accepts data from anyone on the internet), can hijack a trusted agent, extract sensitive CRM data and, in a third variant, use the Slack agent’s identity to distribute phishing anonymously.
According to Zenity’s report, the initial report to Salesforce was on June 1, 2026, Salesforce acknowledged the investigation the next day, and the fixes were confirmed on August 18 and verified by Zenity on August 19. The case was made public in late September. In other words: the flaw is already fixed on Salesforce’s side, but the attack pattern remains valid for any agent that reads untrusted data.
The attack is an indirect prompt injection: the attacker never talks to the agent; they leave hidden instructions in a lead’s text fields. Those instructions sit dormant in the CRM until an employee asks a routine question, such as “review my most recent leads.” At that moment the agent reads the lead, interprets the attacker’s text as instructions, and acts on it.
Zenity points out that the general CRM subagent had, with default permissions, read access to the Leads and Accounts tables, which allowed extracting data such as company names and deal sizes.
Salesforce has a control called Trusted URLs that redacts untrusted destinations. Zenity found two parsing edge cases: domains with unrecognized TLDs (the example was .fun) weren’t treated as hostnames, and terminators such as braces {} and brackets [] created a mismatch between the redactor and the browser. A string like https://random_string.oast.fun/{email} got past the filter.
That enabled two exfiltration variants with no human interaction:
img tag with an external source loads on its own and triggers a DNS query to the attacker’s domain, with the data in the subdomain or path.The third flaw allowed abusing the Slack agent’s trusted identity to send phishing messages with no attribution to the attacker.
Practical checklist:
If you’re deploying agents on a CRM or other systems holding customer data and want an architecture review, write to us at info@guatemalia.com.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel