SalesBleed: Three Agentforce flaws allowed a CRM to be emptied without a single click

A booby-trapped contact form was enough to hijack a Salesforce agent: two of the three flaws found by Zenity Labs were exfiltrating data from the CRM without any action from the victim.

Zenity Labs reported to Salesforce on June 1, 2026, three vulnerabilities in Agentforce grouped under the name SalesBleed. The entry point is not an exotic component but the official mechanism for collecting leads, Web-to-Lead forms, which lead directly into the CRM. Malicious instructions slipped into a form remain dormant until an employee asks an agent to process the file: the agent then executes the hidden instructions.

Two of the three flaws resulted in data being exfiltrated from the CRM without any clicks from the victim. The third made it possible to turn the agent into a sender of phishing messages — a detail that counts, since the victim then receives a message from an internal system already considered trustworthy, and not from an unknown sender.

Technically, the researchers bypassed Trusted URLs, the safeguard that is supposed to limit the external destinations accessible to an agent and hide links or images pointing to unauthorized domains. The mechanism did not recognize certain top-level domains, and the insertion of particular characters disrupted address analysis. Salesforce says it has fixed all three defects as of August 19, 2026. The attack chains described no longer work, but they illustrate the difficulty of framing what an agent can actually achieve when it crosses the limits provided for it.