SalesBleed: Zero-Click Data Exfiltration via Salesforce Agentforce Flaws
Written by AI from the linked story. Not reviewed by an editor. How this works
Three vulnerabilities in Salesforce Agentforce—collectively dubbed 'SalesBleed'—allowed attackers to hijack trusted AI agents to exfiltrate sensitive data and launch phishing campaigns without requiring any user interaction. Two flaws exploited Web-to-Lead forms to bypass Trusted URL controls, enabling zero-click data theft, while a third weaponized the Agentforce-Slack integration as a phishing vector. This incident highlights the expanding attack surface introduced by AI-driven automation platforms and third-party integrations, which can inherit or amplify trust relationships in dangerous ways. Organizations must treat AI agent configurations and integration points as first-class security assets requiring rigorous review and timely patching.
Tactical Insight
Immediate actions
- Apply Salesforce's patches for the three SalesBleed vulnerabilities across all affected Agentforce instances immediately.
- Audit and tighten Trusted URL allowlists in Salesforce to enforce least-privilege for all agent-accessible endpoints.
- Review and restrict Agentforce-Slack integration permissions to the minimum required scope.
Configuration & hardening
- Regularly review and harden AI agent configurations, treating them with the same rigor as application code and API surfaces.
- Disable or scope-limit Web-to-Lead forms and similar public-facing intake mechanisms where full functionality is not required.
- Enforce strict allowlisting of external services that AI agents are permitted to communicate with.
Detection & long-term improvements
- Implement monitoring and alerting on anomalous Agentforce activity, including unexpected data queries or outbound requests to external URLs.
- Establish a recurring vulnerability assessment cadence specifically targeting AI/automation platform integrations and their trust boundaries.
- Include AI agent platforms and SaaS integrations in your third-party risk and patch management programs.