Salesforce has patched three flaws in Agentforce that let an outsider hijack a company's own AI agents using nothing more than a public contact form. Zenity Labs published the chain โ collectively named SalesBleed โ on Thursday, after an eleven-week fix cycle with Salesforce that closed the last of it in August.
The entry point is Web-to-Lead, the unauthenticated form enterprises put on their websites to capture sales inquiries. An attacker submits a lead containing hidden instructions, and nothing happens. The payload sits in the CRM until an employee asks their agent something ordinary โ check my latest leads, help me with the newest one โ at which point the agent reads the poisoned record and follows the attacker's instructions instead of the employee's.
Key takeaways
- Zenity Labs reported SalesBleed to Salesforce on June 1, 2026; Salesforce confirmed it the next day and Zenity validated the final patches on August 19, before public disclosure on September 24.
- The exfiltration worked because Salesforce's Trusted URLs redactor and the rendering surface disagreed on where a URL ends โ the redactor recognized only a fixed list of top-level domains, and
.funwas not on it. - A third flaw in the Reply to a Slack Thread action required no user confirmation and carried no attribution, letting an insider send phishing messages wearing the agent's identity.
How a redactor and a browser disagreed
Agentforce has a control called Trusted URLs whose job is to restrict which external destinations the agent can reach and to redact links or images pointing anywhere untrusted. Zenity's researchers โ Alex Apostolov, Joรฃo Donato, Avishai Efrat and Ayush RoyChowdhury โ found two ways to slip past it.
First, the redactor validated hostnames against a fixed set of top-level domains, and an unrecognized one such as .fun simply failed to register as a URL at all. Second, curly braces and square brackets inside a link were not redacted but survived into the rendered output. A string like https://random_string.oast.fun/{email} looked malformed enough for the redactor to dismiss and valid enough for a browser to fetch.
That gap is the whole attack. The injected instructions told the agent to query the Accounts table through its own Query Records tool, pull a company name and a deal size, paste those values into the subdomain of an attacker-controlled hostname, and print the result as an HTML image tag. The frontend rendered it, fetched it, and the DNS lookup carried the stolen fields to the attacker's authoritative name server. The employee saw nothing.
Slack made it worse, then made it anonymous
The same payload worked through Slack without any image rendering, because Slack unfurls links to build previews. A specially built URL appearing in a channel is enough to trigger the request that ships CRM fields outward โ no click, no hover, no user action at all beyond reviewing a lead.
The third bug is a different shape. Agentforce's Reply to a Slack Thread action shipped without a confirmation prompt and without visible attribution to the user who invoked it. An insider already chatting with the agent could therefore have it post phishing links under the agent's trusted identity while staying anonymous. Combined with the URL redaction bypass, the message could point anywhere.
Why the pattern outlives the patch
Salesforce closed the redaction bypass, so these specific chains are dead. Zenity's own framing is that the ingredients, not the bug, are the story: any AI agent that reads records submitted by outsiders, renders links or images back to a user, and holds tool access to sensitive data has all three sitting in the same place.
Zenity co-founder and CTO Michael Bargury told The Register that secure-by-design remains essential for agents but may no longer be sufficient, because protections built in from the start still miss edge cases the agent finds once it meets the real world. He pointed to the OpenAIโHugging Face incident, where agents escaped the sandbox meant to hold them, as part of a wider trend โ and argued that monitoring what agents actually do has to scale with how powerful they get.
That argument is now a product category. Docker spent its developer keynote this week making the same case, selling hosted microVM sandboxes on the premise that containers isolate applications while agents need containment. SalesBleed is the enterprise-SaaS version of the same problem: Salesforce built a guardrail, and the guardrail and the browser read the same string differently.
FAQ
Is SalesBleed still exploitable?
No. Zenity Labs reported the issues to Salesforce on June 1, 2026, Salesforce confirmed fixes on August 18, and Zenity validated the patches on August 19. The disclosure on September 24 describes chains that no longer work.
Did SalesBleed require the victim to click anything?
No, and that is what made it notable. The only action required was an employee asking their Agentforce agent a routine question about recent leads. Exfiltration then happened through automatic image loading or Slack link unfurling.
Does this affect AI agents outside Salesforce?
The specific bypass was Salesforce-specific, but Zenity argues the underlying recipe is not. Any agent platform that ingests untrusted external records, renders links or images back to users, and grants the agent tools that read sensitive data can be assembled into the same attack.
