Full Report
'SalesBleed' security flaws 'lead to very unexpected consequences'
Analysis Summary
# Vulnerability: SalesBleed (Salesforce Agentforce Indirect Prompt Injection)
## CVE Details
- **CVE ID**: Not yet assigned (Disclosed by Zenity Labs as "SalesBleed")
- **CVSS Score**: N/A (Severity: Critical/High based on 0-click data theft potential)
- **CWE**: CWE-506 (Embedded Malicious Code), CWE-116 (Improper Encoding or Escaping of Output), CWE-79 (Cross-site Scripting - via HTML img tags)
## Affected Systems
- **Products**: Salesforce Agentforce, Salesforce Web-to-Lead forms, Slack (via Salesforce integration).
- **Versions**: All versions prior to the September 2026 patches.
- **Configurations**:
- Environments using **Agentforce** AI agents.
- Organizations using **Web-to-Lead** public forms.
- Organizations with Agentforce integrated into **Slack**.
- Environments relying on **Trusted URLs** for content filtering.
## Vulnerability Description
SalesBleed consists of three distinct flaws that allow for the compromise of AI agents:
1. **Trusted URLs Redaction Bypass**: A flaw in Salesforce's URL filtering mechanism where the system failed to register hostnames with unrecognized top-level domains (TLDs) or specific special characters. This allowed attackers to bypass "Trusted URL" restrictions.
2. **0-Click Data Exfiltration**: By abusing the bypass above, an attacker could use an **Indirect Prompt Injection** (via a public lead form) to instruct an AI agent to query internal CRM tables (e.g., Accounts). The agent would then embed the stolen data as a subdomain in an HTML `<img>` tag. The frontend rendered these tags automatically, sending the data to an attacker-controlled DNS/HTTPS server.
3. **Anonymous Phishing (Slack)**: The "Reply to a Slack Thread" action lacked user confirmation and attribution. An agent could be manipulated via prompt injection to send phishing links within Slack threads, appearing to come from the trusted agent's identity rather than the attacker.
## Exploitation
- **Status**: PoC available (demonstrated by Zenity Labs). Fixed by vendor.
- **Complexity**: Medium (Requires knowledge of prompt injection and Salesforce table structures).
- **Attack Vector**: Network (Indirect via public web forms).
## Impact
- **Confidentiality**: **High** (Silent exfiltration of CRM data, account details, and deal sizes).
- **Integrity**: **Medium** (Ability to post unauthorized messages in Slack).
- **Availability**: **Low** (Primary impact is data theft and deception).
## Remediation
### Patches
- Salesforce has implemented server-side fixes as of **September 21, 2026**.
- The **Trusted URLs** mechanism has been updated to correctly parse and redact unrecognized TLDs and special characters.
- **Agentforce Slack actions** (specifically "Reply to a Slack Thread") now include improved attribution and control measures.
### Workarounds
- Ensure "User Confirmation" is enabled for all AI agent actions that interact with external communication channels (Slack, Email).
- Sanitize and review data coming from public-facing forms (Web-to-Lead) before allowing AI agents to process them.
## Detection
- **Indicators of Compromise**:
- Unusual DNS queries to unrecognized TLDs containing encoded strings.
- Agent logs showing the "Query Records" tool being used immediately followed by rendering `<img>` tags to external sources.
- Slack threads where the Agentforce agent posts links without a corresponding user trigger.
- **Detection methods**: Monitor Salesforce audit logs for AI agents accessing the `Accounts` or `Leads` tables in response to prompts originating from external data.
## References
- Zenity Labs Technical Report: hxxps[://]labs[.]zenity[.]io/post/salesbleed-0-click-data-exfiltration-on-agentforce
- Zenity Labs Phishing Report: hxxps[://]labs[.]zenity[.]io/post/salesbleed-hijacking-agentforce-in-slack-for-anonymous-phishing
- Video Proof-of-Concept: hxxps[://]www[.]youtube[.]com/watch?v=p5ePMGh-OL4
- Salesforce Trusted URLs Documentation: hxxps[://]help[.]salesforce[.]com/s/articleView?id=xcloud[.]shr_manage_trusted_url[.]htm&type=5