SalesBleed: Agentforce Flaws Enable Data Exfiltration

Three vulnerabilities in Salesforce Agentforce, collectively tagged “SalesBleed” by researchers, expose the platform’s AI agent layer to zero-click data exfiltration and phishing delivered through trusted internal channels.

The attack chain starts with indirect prompt injection. Agentforce processes external web content on behalf of users as part of automated workflows. A malicious page embeds instructions in that content; the agent executes them without any separate trigger from the user who initiated the task. No click, no interaction: the victim starts a routine workflow, the agent fetches a page, and the injected payload becomes a command.

Two additional weaknesses compound that entry point. Trusted agents can be hijacked to move instructions across application boundaries, including into Slack workspaces where the agent holds posting rights. From there, a message from a known system integration lands in a workspace channel carrying the same implicit trust as any other automated system notification, with no obvious sign that its content was shaped by a third party.

SecurityWeek reported the disclosure on September 25. A Dark Reading analysis adds detail on the cross-platform reach: once an agent has posting access to internal channels, injected instructions do not stay inside the Salesforce boundary.

Salesforce Agentforce integrations are documented as trusted connectors to CRM records, calendars, and internal tooling. That trust model is what the three flaws leverage. No external authentication is bypassed; the agent carries its own permissions, and the attack rides them.

CVE identifiers and official patch status were not confirmed in either initial report. Salesforce’s security advisories should be the first stop for remediation guidance when it publishes.

The blast radius is proportional to what the agent can reach. Audit which external URLs your Agentforce deployments are permitted to fetch. Reduce Slack integration scopes for any Agentforce connectors to the minimum posting rights the workflow actually requires.

This fits a pattern visible across agentic AI infrastructure this year: see the unauthenticated RCE in AutoAgent and the LightLLM config server flaw for parallel examples of trust assumptions in AI tooling that attackers are learning to exploit.