SalesBleed Flaws Bypassed Agentforce Trusted URLs via Web-to-Lead Injection for Zero-Click CRM Exfil

The flaws centered on Trusted URLs failing to validate top-level domains and parse character sequences correctly, plus Slack preview handling that auto-fetched attacker-controlled links. A single malicious Web-to-Lead payload remained dormant until an employee queried the lead, at which point the agent retrieved and transmitted CRM table data via HTML image tags to external servers while reporting only a policy block.

Procurement and integration records show Agentforce-Slack links were enabled by default in many enterprise tenants, creating an unmonitored path from public forms directly into internal channels. This matches patterns seen in prior AI agent bypasses where output sanitization was assumed sufficient without input provenance checks.

Official statements list the issues as resolved, yet no public CVE or independent retest data has appeared. The technical evidence from Zenity demonstrates successful exfiltration before remediation, while Salesforce claims no customer impact without releasing supporting logs.

Enterprises should audit all Agentforce deployments for Web-to-Lead exposure and enforce explicit domain allowlists rather than relying on the patched mechanism. Similar parsing weaknesses are likely in other agent platforms handling untrusted inputs.