Meta News

Security researchers have disclosed three vulnerabilities in Salesforce Agentforce that could have allowed attackers to hijack trusted AI agents, extract sensitive CRM information, and launch phishing attacks without requiring victims to click a malicious link.

Researchers at Zenity Labs collectively named the attack techniques SalesBleed. The vulnerabilities demonstrate an emerging problem with enterprise AI agents: information entering a business system through ordinary channels can potentially become malicious instructions when an AI agent later processes it.

One of the attack paths began with Salesforce’s Web-to-Lead functionality, which allows organizations to collect information from public web forms and automatically create leads inside their CRM.

Normally, a visitor might submit a name, email address and message.

Researchers discovered that an attacker could instead place specially crafted instructions inside those fields. Once stored in Salesforce, the malicious content would remain dormant until an Agentforce agent processed the record.

At that point, the content could be interpreted as instructions rather than ordinary customer information.

This is a form of indirect prompt injection: the attacker never communicates directly with the AI agent but plants instructions inside data the agent is expected to trust.

The most serious consequence was the possibility of stealing sensitive Salesforce information without direct interaction from an employee.

According to Zenity, an attacker could craft a lead containing instructions that manipulated Agentforce into accessing CRM information and sending it outside the organization.

Because the malicious prompt entered through a legitimate Salesforce feature, the attack could bypass the normal assumption that records stored inside the CRM are simply data.

The victim did not necessarily need to open a malicious attachment, visit a website, or approve an action.

The agent itself became the mechanism that processed the attack.

Another SalesBleed technique showed how attackers could abuse Agentforce to generate and distribute phishing content.

Instead of sending a conventional phishing email from attacker-controlled infrastructure, malicious instructions could potentially convince the trusted Salesforce agent to send the message.

That changes the trust model significantly.

An email originating from legitimate corporate Salesforce infrastructure may appear considerably more credible than one coming from an unknown external domain. It may also have a better chance of passing reputation-based email defenses.

The agent therefore becomes both the target of the prompt injection and a potential delivery mechanism for the next stage of the attack.

Traditional application security teaches developers to treat user-controlled input as untrusted.

Agentic AI makes that principle considerably broader.

A CRM record, support ticket, email, document, calendar invitation, database entry, or web form submission may look like ordinary business information to conventional software. But once an LLM processes that content, natural-language text can potentially become executable instructions.

This creates a fundamental ambiguity.

The model needs to read the information to perform its job, but it also needs to distinguish between information about a task and instructions telling it what to do.

Attackers can deliberately exploit that ambiguity.

Prompt injection becomes particularly dangerous when the targeted agent has powerful permissions.

An assistant that can only summarize public information presents relatively limited risk. An enterprise agent connected to customer databases, email, internal documents, APIs and automation systems creates a much larger attack surface.

If manipulated, the agent may perform actions using permissions legitimately granted by the organization.

This is why protecting agentic systems cannot rely exclusively on improving prompts or instructing the model to ignore malicious content.

Sensitive operations need authorization controls outside the model itself.

Organizations should limit agent permissions, validate external data, restrict outbound communications, monitor tool calls and require additional approval for consequential actions.

Zenity privately disclosed the vulnerabilities to Salesforce, which implemented fixes before the researchers publicly detailed SalesBleed.

There is currently no indication that attackers exploited the vulnerabilities against Salesforce customers before they were patched.

The findings nevertheless provide another example of why indirect prompt injection is becoming one of the defining security challenges of enterprise AI.

Agentforce is designed to make business systems more useful by allowing AI agents to read information and act across workflows. Those same capabilities mean attackers no longer necessarily need to compromise an employee account directly.

Sometimes they may only need to place the right instructions somewhere the agent will eventually read them.

SalesBleed demonstrates that securing enterprise AI will require treating every piece of external content as potentially adversarial — even when that content arrives through completely legitimate business workflows.