CybersecuritySalesBleed and Salesforce Agentforce: What Zero-Click Prompt Injection Teaches About AI Agent Security
SalesBleed research showed how malicious content in public Salesforce inputs could influence Agentforce workflows, exfiltrate CRM data or support phishing paths. The flaws were fixed, but the design lessons apply broadly to enterprise AI agents.
Verified for technical accuracy — Kodi C.
Archive coverage note: This Zeph Tech briefing was published on September 27, 2026 and documents a security development from . The historical date in the URL identifies the covered event; it is not a claim that Zeph Tech originally published the page on that date.
AI agents create a new security boundary because they transform untrusted text into decisions and actions. Traditional input handling asks whether data can break a parser; agent security must also ask whether data can persuade a trusted model to misuse tools or disclose information.
What happened
Zenity Labs disclosed a set of Agentforce issues it called SalesBleed. The research described attack paths in which malicious instructions could enter Salesforce through public-facing records such as Web-to-Lead, remain dormant, and later influence an internal agent when that content was processed. Zenity states that Salesforce investigated the findings and confirmed fixes before public disclosure.
- Researchers described indirect prompt-injection paths originating from untrusted CRM content.
- The reported attack chains included data-exfiltration and Slack-phishing scenarios.
- Zenity's timeline says Salesforce fixed the reported Trusted URLs bypass and changed Slack-related defaults and attribution behavior.
- The research team confirmed all described fixes by September 21, 2026.
Why defenders should care
The significance is larger than one Salesforce bug. Many enterprise agents read customer-submitted content, documents, tickets, email and chat while also holding access to internal records or write-capable tools. That combination creates an instruction/data ambiguity attackers can exploit.
- Untrusted business data can become an instruction channel if the agent does not distinguish content from authority.
- Tool-enabled agents can turn model misinterpretation into real external actions.
- Allowlist and URL controls can fail if alternate encodings or rendering paths are overlooked.
- Agents that speak with a trusted organizational identity can amplify phishing and impersonation risk.
Priority response
Organizations affected by this development should treat remediation as an operational workflow rather than a single patching checkbox. Confirm exposure, reduce reachable attack surface, apply the vendor-supported fix or control, and then verify whether compromise may have occurred before remediation.
- Inventory AI agents that process external or user-controlled content and document every tool they can call.
- Require user confirmation for consequential write actions unless a narrowly scoped exception is justified and tested.
- Apply least privilege to agent data access so one poisoned record cannot expose unrelated sensitive datasets.
- Test indirect prompt injection through the real ingestion channels used in production, not just direct chat prompts.
- Restrict and monitor outbound destinations available to agent workflows and rendering components.
- Log agent tool calls, initiating user context, retrieved records and resulting external actions in a reviewable audit trail.
Detection and verification
Detection should focus on agent behavior as well as traditional application logs: unusual tool sequences, outbound requests to previously unseen destinations, bulk record access following interaction with one external record, write actions without expected user confirmation, or agent-generated Slack messages that do not match normal workflows.
Preserve relevant logs before disruptive remediation when practical, compare current configuration with a known-good baseline, and document both the technical fix and the evidence used to determine whether follow-on incident response is required. Where a vulnerability is known to be exploited, patch status alone does not answer whether the system was already compromised.
Longer-term security lesson
AI agent security is an authorization problem as much as a model-safety problem. A robust design assumes that retrieved content can be malicious, keeps data separate from trusted instructions, limits tool authority, makes high-impact actions observable, and preserves human approval where the cost of a wrong action is material.
For program owners, this event is also a useful test of asset inventory, ownership, vulnerability prioritization, evidence retention, and communication. Teams should be able to identify affected systems quickly, name an accountable owner, record the mitigation decision, and prove that the control change reached production. Those capabilities are often more important than any one scanner score.
Questions teams should be able to answer
Were the SalesBleed issues fixed?
Zenity reports that the disclosed issues were fixed and that all described fixes were confirmed by September 21, 2026.
What is indirect prompt injection?
It occurs when an agent consumes malicious instructions embedded in data or content that the user did not directly type as an instruction, such as a CRM record, document or webpage.
What is the most important defensive control?
There is no single control. Least privilege, tool confirmation, destination restrictions, untrusted-content handling and high-quality audit logs work together to reduce risk.
Related Zeph Tech guidance
Use the Vulnerability Management Program guide to turn urgent advisories into a repeatable remediation workflow, the free cybersecurity risk register to record residual exposure and treatment ownership, and the Cybersecurity hub for broader defensive guidance.
Scope the operational blast radius
Map every source of content an Agentforce workflow can ingest and label it by trust level: public form, customer record, uploaded document, webpage, employee message or controlled system data. Then map every tool and data set the agent can reach after consuming that content. Low-trust input combined with high-authority tools is the central risk.
Retain initiating user context, retrieved records, model or agent trace data where available, tool calls, destination URLs, CRM reads and writes, Slack or email actions, policy decisions and any human approval. An investigation should be able to reconstruct which untrusted content influenced which external action without relying on the model's natural-language explanation alone.
Turn remediation into an auditable control
Use purpose-specific agent identities, least-privilege data access, explicit tool allowlists, destination controls and independent validation of tool arguments. Require user confirmation for consequential writes, sensitive exports or external messages unless a narrowly scoped automated action has been separately justified and tested.
Measure whether the control is improving instead of counting closed tickets. Useful indicators for this topic include agents with internet egress; tools that can write without confirmation; sensitive-object access by agent identities; blocked destination attempts; indirect prompt-injection test pass rate; and time required to trace an agent action back to its initiating content and user. Review the measures after material architecture changes and after incidents so the program does not optimize for a stale threat model.
Owner handoff before closure
Before closing the response to Salesforce Agentforce, the technical owner and the risk owner should agree on what evidence demonstrates completion. Record the affected inventory, final software or configuration state, temporary controls still in place, credentials or identities changed, detection coverage added, and any systems excluded from remediation with an explicit reason. Confirm that monitoring will detect recurrence and that the service owner knows which future change would invalidate the current risk decision. If the event exposed an inventory, logging, ownership or recovery gap, assign that gap as separate tracked work instead of burying it inside the original patch ticket. A short post-response review should also capture which step consumed the most time and which dependency prevented faster action. That information is operationally valuable: it lets the next incident start with a tested owner map, reliable evidence sources and a known containment path rather than repeating discovery under pressure.
Cited sources
- SalesBleed: Hijacking Agentforce in Slack for Anonymous Phishing Attacks — Zenity Labs
- 'SalesBleed' Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration — SecurityWeek
Continue in the Cybersecurity pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Network Security Fundamentals: Segmentation, DNS, Zero Trust & Monitoring | Zeph Tech
A 2026 practitioner guide to network segmentation, firewall policy, DNS security, remote access, encrypted traffic, monitoring, administration, and zero-trust architecture.
-
Small Business Cybersecurity Survival Checklist
A practical 2026 cybersecurity operating guide for small and medium-sized businesses, organized around NIST CSF 2.0 and current FTC guidance with bounded Verizon DBIR threat…
-
Cybersecurity Operations Playbook
Build a defensible cybersecurity operations program around NIST CSF 2.0, current incident-response guidance, exploited-vulnerability prioritization, evidence capture, and…
Coverage intelligence
- Published
- Coverage pillar
- Cybersecurity
- Source credibility
- 40/100 — low confidence
- Topics
- Salesforce Agentforce · SalesBleed · Prompt injection · AI agent security · CRM security
- Sources cited
- 2 sources (labs.zenity.io, securityweek.com)
- Reading time
- 6 min
Source feedback
Editorial
Found a factual issue, superseded source, broken citation, or important context we should review? Send the specific claim and supporting source through the correction path so it can be evaluated against the article record.