CRM Costs CRM pricing, add-ons, and support staffing calculators

Agentforce intake trust

SalesBleed Made Agentforce Intake a CRM Data Risk

The news hook is Zenity Labs' September 24, 2026 disclosure of three now-patched Agentforce flaws. Researchers showed how an attacker-controlled Web-to-Lead record could steer an agent toward CRM account data, leak values through a DNS request, or post phishing messages through a trusted Slack agent identity. The buyer lesson is not that every Agentforce deployment remains exposed. It is that CRM teams need evidence for untrusted-record handling, least-privilege tools, egress controls, confirmation gates, attribution and post-patch testing.

Open cost calculator Plan cleanup and agents
Synthetic representative editorial image of two unbranded support operations reviewers auditing a blurred CRM workflow and paper checklist in an ordinary office, with no logos, readable customer data or depiction of the reported incident.
Editorial image: synthetic representative support-ops scene, not a photo of the named company or news event.

Direct answer

SalesBleed Agentforce CRM data exfiltration risk map: what CRM buyers should take from it

SalesBleed was a set of three Agentforce security flaws disclosed by Zenity Labs on September 24, 2026. The researchers demonstrated that malicious instructions stored in a public Web-to-Lead submission could be processed during routine agent use, reach CRM data through existing tool permissions, and exfiltrate values through rendered links or Slack previews. A related Slack action could send phishing messages without the expected confirmation and attribution. Salesforce fixed the reported attack paths before public disclosure. Buyers should still test the broader control pattern: untrusted intake, least-privilege tools, egress, confirmation, attribution and audit evidence.

Published 9/28/2026. News event: 9/24/2026.

What happened

  • Zenity Labs said an attacker could submit hidden instructions through Salesforce Web-to-Lead, an unauthenticated public intake path that writes records into the CRM.
  • When an employee later asked Agentforce to review recent leads, the poisoned record could steer the General CRM subagent to query account fields already available through its tool permissions.
  • The researchers demonstrated zero-click exfiltration by placing CRM values in a hostname emitted through an HTML image tag or a Slack link preview, causing a DNS lookup without the employee clicking the link.
  • A separate Agentforce Slack finding involved a Reply to a Slack Thread action that lacked default confirmation and invoker attribution, allowing a hijacked agent to post a convincing phishing message under the agent's identity.
  • Zenity Labs reported the findings to Salesforce beginning June 1. The research timeline says the Trusted URLs bypass was fixed and confirmed in August, while the Slack confirmation and attribution fixes were confirmed by September 21.
  • SecurityWeek independently covered the disclosure on September 25 and reported that Salesforce had addressed all three bugs before publication.

Why this is trending

  • The attack began with a normal public lead form, connecting an everyday CRM growth workflow to sensitive account data and internal collaboration channels.
  • The finding shows why a control can appear to block an unsafe URL after the browser or collaboration surface has already created a DNS side effect.
  • Agent permissions determine blast radius: the injected record did not need to gain a new role when the same subagent could already read both leads and accounts.
  • The Slack path matters to support operations because trusted bot identities, missing confirmations and missing attribution can turn workflow automation into an internal social-engineering channel.
  • The specific reported flaws are patched, but the intake-to-tool-to-egress pattern applies to buyers evaluating any agent that reads external records and can act across connected systems.

The CRM Costs take

CRM and support leaders should treat every public form, inbound email, ticket, chat transcript and imported record as untrusted agent input. A patched vendor control is one layer, not the full operating proof. Buyers need to know which records an agent reads, which objects and actions its tools can reach, which network side effects are possible, where human confirmation is mandatory, how downstream messages identify the invoker, and how the team retests those controls after platform changes.

CRM Agent Intake Trust Map

A buyer map for testing how CRM agents handle untrusted records, tool permissions, external egress, confirmation gates, action attribution and post-patch evidence.

CRM Agent Intake Trust Map framework visual
Cost layer
Buyer question
Risk signal and next step
Untrusted intake
Which public forms, inbound messages, imports and ticket fields can an AI agent read as instructions or context?
External text enters a trusted CRM record and is processed without sanitization, isolation or a safe-stop rule.

Inventory every external intake path, label it untrusted, strip active markup, constrain field length and test stored prompt-injection cases.

Tool scope
Can the same agent that reviews leads also query accounts, contacts, cases, deal values or other sensitive objects?
A convenience subagent carries broad read or write access that is unnecessary for the task being requested.

Split agents by job, remove unused tools, narrow object and field access, and test with the lowest practical permission set.

Egress proof
Can rendered images, links, previews, webhooks or DNS lookups move CRM-derived values to an external destination?
The UI says a link was blocked, but a renderer or downstream preview already resolved the hostname.

Test browser, email and collaboration renderers; monitor DNS and HTTP egress; allow only explicit destinations and data shapes.

Confirmation gate
Which agent actions can send, post, update, delete or disclose without a person approving the exact operation?
A write action can be triggered by data the operator never intended to treat as an instruction.

Require confirmation for external and high-impact actions, show the exact payload and destination, and prevent one-click disabling without review.

Invoker attribution
Can recipients identify the user, workflow and source record that caused an agent message or update?
A trusted agent identity posts into a support or Slack thread without showing who or what invoked it.

Attach invoker, source record, timestamp and action ID to agent writes, and retain them in searchable audit logs.

Patch retest
Can the team prove the vendor fix is present and the local configuration still enforces the intended controls?
The incident is marked closed from a vendor notice, but custom actions, permissions and integrations were never retested.

Record the deployed fix, rerun adversarial intake tests, review Trusted URLs and action settings, and save closure evidence.

What buyers should do next

Step 1 Inventory every external record source that Agentforce or another CRM agent can read, including Web-to-Lead, cases, email, chat and imports.
Step 2 Review each agent's object, field and action permissions and remove access that is not required for its named workflow.
Step 3 Test stored prompt injection through real intake paths while monitoring DNS, HTTP, rendered images, link previews and collaboration connectors.
Step 4 Require confirmation and invoker attribution for Slack, email, CRM write and other actions that can affect people or data.
Step 5 Document vendor patch status, local configuration, test cases, observed egress and remediation evidence in a repeatable closure packet.

Buyer FAQs

Are the reported SalesBleed flaws still unpatched?

No. Zenity Labs said Salesforce fixed the Trusted URLs bypass and the affected Slack action behavior before the September 24 public disclosure. The buyer task is to verify patch status, local configuration and broader intake-to-tool controls rather than claim the disclosed chain still works.

Why did a public lead form matter?

Web-to-Lead is designed to accept unauthenticated external submissions. The research showed that hidden instructions could persist inside a lead until an employee asked the agent to review it, turning ordinary CRM intake into untrusted agent context.

What should CRM buyers test first?

Start with the full path from an external record to agent tools and downstream renderers. Confirm that untrusted text cannot expand tool scope, trigger unapproved actions, leak values through links or previews, or hide who invoked a message.