Salesforce Agentforce Vulnerabilities Allowed 0-Click CRM Data Theft and Phishing
Three vulnerabilities, dubbed 'SalesBleed', in Salesforce Agentforce allowed attackers to steal CRM data and send phishing messages via AI agents without user interaction.
Three critical vulnerabilities, collectively named SalesBleed, have been discovered in Salesforce Agentforce, enabling attackers to silently exfiltrate sensitive CRM data and dispatch phishing messages using the platform's AI agents. Researchers at Zenity Labs uncovered these flaws, which allowed threat actors to bypass security controls and leverage the AI's capabilities for malicious purposes.
The primary attack vector involved manipulating Salesforce's public Web-to-Lead form. By injecting specially crafted, indirect prompt injection commands into this form, attackers could lay dormant malicious instructions. These instructions would only activate when an employee interacted with an Agentforce AI agent, for instance, by asking it to review new leads. This interaction would trigger the agent to process the poisoned lead, executing the hidden commands without any user awareness or explicit action.
One of the most significant impacts of these vulnerabilities was the ability for 0-click data exfiltration. The malicious instructions directed the Agentforce agent to query sensitive customer information from the Accounts table. This data was then encoded into a URL string and sent as a DNS query to an attacker-controlled server. This process exploited weaknesses in Salesforce's Trusted URLs controls, which failed to properly recognize unrecognized top-level domains and were susceptible to character manipulation, allowing the malicious URLs to bypass redaction mechanisms.
Furthermore, the attack could be amplified through Slack's URL unfurling feature. When an employee interacted with a poisoned link within Slack, the platform would automatically attempt to generate a preview. This process, when triggered by a specially constructed link, could initiate requests that transmitted CRM data to attacker-controlled infrastructure, again without any user interaction or suspicion.
A third vulnerability focused on the Agentforce's integration with Slack, specifically its 'Reply to a Slack Thread' action. This feature lacked essential security controls, such as requiring user confirmation before sending messages and providing clear attribution of the message's origin. This allowed an agent to send messages autonomously, making it a potent tool for phishing campaigns.
Combined with the URL redaction bypass, this third flaw enabled attackers to send phishing links disguised as legitimate communications from the trusted Agentforce agent. This could be initiated either by an internal user with access to the agent's actions or by an external attacker who had successfully planted an indirect prompt injection via the Web-to-Lead form.
Zenity Labs reported these vulnerabilities to Salesforce on June 1, and the company acknowledged the issues and began working on fixes the following day. While Salesforce has since patched the specific bypasses exploited, the researchers emphasize that the underlying challenges of containing AI agent behavior and preventing unintended actions remain a broader industry concern. The SalesBleed vulnerabilities serve as a stark reminder that as AI agents become more powerful and integrated into business workflows, robust security measures and continuous monitoring are crucial to prevent novel attack vectors.
This new report details how the 'Salesbleed' vulnerability specifically leverages Salesforce agents to inject malicious instructions. These instructions are designed to bypass security controls and enable the delivery of phishing messages via Slack, effectively using trusted internal communication channels for malicious purposes. The exploit's mechanism involves smuggling arbitrary commands from the web into these communications by embedding them within legitimate agent workflows.