Researchers at Zenity Labs have discovered three vulnerabilities in Salesforce Agentforce that allowed attackers to steal CRM data and send phishing messages via manipulated leads. An attacker didn’t need to log in, and the victim didn’t need to click anything. Salesforce has since fixed the issues.
Zenity collectively refers to the vulnerabilities as SalesBleed. The starting point was Web-to-Lead, which organizations use to add new leads to Salesforce via public forms. An attacker could insert a hidden instruction for the AI agent into these forms.
When an employee later asked Agentforce to view new leads, the agent also read the malicious instruction. Agentforce could then be instructed to retrieve other CRM data.
Permissions were already in place
No additional permissions were required to carry out the attack. The default General CRM subagent that Zenity used for testing could read both leads and account data. In the demonstration, the researchers retrieved company names and deal amounts, among other details, from the Accounts table.
To get that data out, the researchers bypassed Salesforce’s Trusted URLs mechanism. This mechanism is designed to prevent Agentforce from processing untrusted URLs. Differences in how the filter and a browser interpreted URLs made it possible to have a malicious URL processed anyway.
Data leaks via DNS
The stolen data was embedded in the subdomain of a URL controlled by the attacker. Agentforce placed that URL in an HTML tag for an external image. As soon as the interface tried to retrieve the image, it automatically sent a DNS query to the attacker’s server.
The user didn’t have to click on anything. Nor did the HTTP request itself need to succeed: the data had already been sent out via DNS. The same thing could happen to Agentforce agents in Slack because Slack automatically attempts to generate previews of links.
Agent sent phishing messages
A third vulnerability was found in another Slack integration, reports The Register. The Agentforce action “Reply to a Slack Thread” did not require confirmation before a message was sent and did not reveal which user had initiated the action. As a result, phishing links could be sent under the AI agent’s trusted identity.
An external attacker could also trigger this via Web-to-Lead. As soon as an employee processed the manipulated lead with Agentforce, the agent could independently post a phishing message in Slack.
Salesforce patches vulnerabilities
Furthermore, a manipulated lead remained in Salesforce and could be reactivated whenever an employee processed it.
Zenity reported the three vulnerabilities to Salesforce on June 1. On August 19, the researchers confirmed that the Trusted URLs bypass had been fixed. On September 21, after conducting tests, they concluded that all three vulnerabilities had been resolved.
According to Zenity, the underlying risk is not limited to Salesforce. AI agents that process external data while simultaneously accessing sensitive business information via tools may face similar issues.