Three Bugs, One Untrusted Lead
Something as small and mundane as a contact form on a company's own website just became one of the more interesting attack surfaces in enterprise software. On September 24, security research firm Zenity Labs disclosed a set of three vulnerabilities in Salesforce's Agentforce platform, collectively named SalesBleed, that let a single untrusted submission hijack a company's own trusted AI agent, pull sensitive CRM data out through the back door, and impersonate a company's internal Slack bot to phish its own employees.
How a Contact Form Becomes an Attack Vector
Web-to-Lead is one of Salesforce's oldest and most ordinary features. It is the mechanism that lets a stranger fill out a form on a company's public website and have that information land directly inside the CRM as a new lead record, no login required by design. That is exactly the point of the feature, and exactly why it made such an effective delivery method here.
Zenity's researchers found that a malicious set of instructions could be planted inside a Web-to-Lead submission and would sit completely dormant, doing nothing at all, until an employee later asked their Agentforce agent to look at or process that specific lead. The moment the agent read the poisoned submission, it treated the hidden instructions as legitimate commands from an authorized user rather than untrusted data from a stranger on the internet, and carried them out.
Two of the three vulnerabilities enabled what researchers call zero click data exfiltration. Sensitive information could be pulled out of a company's own Salesforce environment and sent to an attacker's own server without a single employee ever clicking a link, approving a prompt, or doing anything wrong at all. The third let attackers borrow the trusted identity of an Agentforce connected Slack bot, meaning a phishing message sent to employees would appear to come from a tool they already trust and use every day inside their own company's workspace.
Why This Matters Beyond Salesforce
SalesBleed is not really a story about one company's software bug. It is a preview of a problem every business adopting AI agents is going to run into eventually. An AI agent that reads customer submissions, support tickets, or any other form of external content is, by definition, an agent that treats untrusted text as something worth reasoning about. The entire idea behind prompt injection attacks like this one is that an agent cannot always tell the difference between a normal customer inquiry it should summarize and new instructions from its actual owner that it should follow.
Salesforce worked quickly with Zenity's research team once the flaws were reported, fixing the Trusted URLs bypasses that made the exfiltration possible and remediating the Slack impersonation issue within roughly two weeks. That is a good, fast turnaround as vendor responses go. It does not change the underlying lesson. If your business has connected an AI agent, of any kind, to a public facing form, a support inbox, or anything else a stranger can write into, that connection deserves the same scrutiny you would give a new employee's account permissions, not less.
What to Do About It
If your company uses Salesforce Agentforce, confirm the patches Zenity's disclosure prompted have actually reached your org, since configuration and connected app settings still matter even when a vendor pushes a fix. More broadly, audit every AI agent your business has deployed and ask a simple question about each one: what untrusted input can this agent read, and what is it allowed to do once it reads it. An agent that can read a public form and also has access to your CRM's full customer data, or your company Slack, is carrying more risk than most people realize when they turn that access on.
Treat AI agent permissions the way you would treat a new hire's laptop, with the minimum access needed for the job rather than broad standing access granted once and never revisited. At AetherGuard Technologies, this is exactly the kind of gap our security assessments are built to find before an attacker does, whether the AI agent in question is one you built in house or one you turned on inside a platform like Salesforce without a second thought.
