Vulnerabilities · Cloud Security
Salesforce fixes 'SalesBleed' flaws that let hackers steal data and send phishing messages
Three vulnerabilities in Salesforce Agentforce could have let attackers steal CRM data and send phishing messages via Slack. Salesforce says it has fixed the bugs and found no evidence of real-world abuse.
Ross GrantUpdated 3 min read
The short version
Security researchers found three bugs in Salesforce Agentforce that could have let hackers steal company data or send fake messages through Slack. Salesforce says it fixed the problems and has not found any evidence that anyone was attacked. Customers are being advised to check their settings and stay alert for suspicious messages.
What happened?
Researchers at Zenity Labs found three vulnerabilities in Salesforce Agentforce that could have let attackers steal CRM data and send phishing messages via Slack. Salesforce says it fixed the flaws by 19 August 2026 and has found no evidence of real-world abuse.
What are the 'SalesBleed' vulnerabilities?
Security researchers at Zenity Labs found three security flaws in Salesforce's Agentforce, an AI-powered tool used by companies to manage customer relationships. These flaws, named 'SalesBleed', could have allowed attackers to steal sensitive customer data and send phishing messages inside a company's Slack channels. The bugs were reported to Salesforce on 1 June 2026 and, according to the company, were fixed by 19 August 2026. Salesforce says there is no evidence that attackers exploited these flaws against any customer. [SecurityWeek (opens in a new tab)]
How could attackers exploit these flaws?
The vulnerabilities centred on Salesforce's Web-to-Lead forms. These forms let companies collect information from potential customers and feed it directly into their Salesforce system. Zenity Labs found that attackers could submit a specially crafted form containing hidden instructions. When an employee asked Agentforce to process the form, the agent would unknowingly execute these instructions. This could allow attackers to access sensitive data from the company's CRM (customer relationship management) database and send it to a server they controlled, without any clicks or further interaction from staff.
Two of the flaws were in Agentforce's Trusted URLs feature, which is supposed to block the agent from accessing unapproved websites. Zenity Labs discovered that this feature did not properly recognise some domain names and could be tricked by certain character sequences in URLs. This let attackers bypass the security check and exfiltrate data using HTML image tags embedded in the poisoned form.
Phishing via Slack integration
The third flaw involved Agentforce's integration with Slack, a popular workplace messaging app. When Agentforce posted a link in Slack, the app would automatically fetch a preview. Attackers could use this behaviour to make Slack send CRM data to their own servers, again with no user interaction required. Even more concerning, attackers could hijack the Agentforce agent to send phishing messages to internal Slack channels. Because these messages came from a trusted system, employees were more likely to trust them and click on malicious links. If they did, attackers could steal credentials and gain access to other company systems.
What has Salesforce done?
Salesforce says it has fixed all three vulnerabilities. It updated Agentforce's default settings in Slack to require user confirmation before sending messages and strengthened the Trusted URLs feature. The company is also contacting customers to help them review their settings and apply recommended changes. Salesforce stressed that it has no evidence of real-world attacks using these flaws, and that it continues to improve its defences against prompt injection and other AI-related risks.
What should customers do?
If your organisation uses Salesforce Agentforce, check that your system is up to date and review your Slack and Trusted URLs settings as recommended by Salesforce. Be wary of unexpected messages in Slack, even if they appear to come from trusted systems. Train staff to spot phishing attempts and report suspicious activity. As AI tools become more common in business software, attackers are likely to look for new ways to exploit them, so regular security reviews are essential.
What is still unclear?
So far, only SecurityWeek has reported on these vulnerabilities, citing Zenity Labs' research. There is no primary source from Salesforce or Zenity Labs available to the public at this time. The full technical details and the number of potentially affected organisations are not yet known.
Claimed vs confirmed
- Confirmed
Attackers could steal CRM data and send phishing messages via Salesforce Agentforce flaws.
Zenity Labs reported the vulnerabilities; Salesforce confirmed and fixed them.
- Confirmed
No evidence of real-world exploitation of these flaws.
Salesforce stated it has no evidence of exploitation against customers.
The impact
- Money
- Salesforce could face regulatory scrutiny if customer data were exposed. Under UK and EU GDPR, fines can reach up to 4% of global turnover or £17.5m/€20m, though Salesforce says no data was stolen.
- Reputation
- Salesforce's reputation depends on trust in its security. Even unexploited flaws can raise concerns, especially when involving AI-powered tools and internal messaging.
- Customers
- Customers' sensitive data and internal communications could have been at risk. Salesforce advises reviewing settings and training staff to spot phishing.
Why it matters
Salesforce is widely used by businesses to manage customer data. Flaws in its AI-powered tools could put sensitive information and internal communications at risk. Even though Salesforce says no customers were attacked, the incident shows how attackers can target trusted systems to reach employees and steal data.
How does it work?
Attackers could submit a specially crafted Web-to-Lead form containing hidden instructions. When Agentforce processed the form, it would execute these instructions, allowing data exfiltration or phishing via Slack. Weaknesses in the Trusted URLs feature and Slack integration made this possible.
Key points
- Three Salesforce Agentforce flaws could have enabled data theft and phishing.
- Attackers could exploit Web-to-Lead forms to hijack AI agents.
- Slack integration made internal phishing more convincing.
- Salesforce says it fixed the bugs and found no evidence of attacks.
- Customers should review their settings and train staff to spot phishing.
Sources
SecurityWeek
Reference
