Salesforce's flagship AI agent platform, Agentforce, has been caught leaking sensitive customer data for the second time in 14 months through nearly identical attack chains. On September 24, 2026, security firm Zenity Labs published research on a vulnerability chain called SalesBleed that allows attackers to silently extract account information from company CRM systems without any user interaction, warning, or login required.

What Makes SalesBleed Different From Previous Attacks?

While the entry point mirrors a flaw discovered in July 2025 called ForcedLeak, SalesBleed introduces a dangerous new dimension. The attack chain consists of three separate flaws working together. Two enable zero-click data exfiltration straight from a company's CRM database. The third transforms a trusted Slack-integrated agent into an anonymous phishing tool that employees cannot distinguish from legitimate messages.

The attack begins innocuously. An attacker fills out a public Web-to-Lead form, the same widget thousands of companies embed on their marketing pages to capture visitor contact information. Hidden inside one of the text fields is a malicious instruction. When an employee later asks their Agentforce assistant to review recent leads, the agent reads the poisoned lead and executes the embedded command instead of the employee's actual request. According to Zenity's research, the injected instruction told the agent to query the Accounts table, pull company names and deal sizes, and encode those values into a subdomain string. The agent then printed that string as an HTML image tag, which triggered an HTTPS request carrying the stolen data to a server the attacker controlled.

How Did Salesforce's Own Security Control Fail?

Salesforce had already built a defense specifically designed to prevent this scenario. Called Trusted URLs, this redaction layer strips any link pointing to an unrecognized domain out of an agent's response before a user sees it. Zenity Labs identified two edge cases that bypassed this protection entirely.

The first gap involved the redactor's allowlist of recognized top-level domains, which did not include.fun, a domain extension used by the interactsh out-of-band testing platform the researchers employed to prove the exploit. Second, the researchers discovered character-parsing quirks in how the filter identified hostnames, allowing a malformed but still-functional URL to slip through undetected. Together, these two blind spots meant a control built specifically to stop agents from leaking data to untrusted destinations simply did not recognize the destination as untrusted.

Why Do AI Agent Security Failures Keep Following the Same Pattern?

The core issue reflects a fundamental architectural challenge in how large language models (LLMs), the AI systems powering agents, process information. LLMs treat a system prompt, a user's request, and any external text they retrieve, such as a CRM lead field, as one continuous stream of tokens. There is no reliable mechanical way for the model to mark some tokens as trusted instructions and others as untrusted data. A hostile sentence hidden in a web form carries exactly the same authority, from the model's perspective, as a legitimate instruction from an employee.

This architectural reality means that traditional security boundaries, like permission controls and allowlists, become the critical defense layer. When those boundaries have blind spots, the entire system becomes vulnerable. The pattern security researchers keep flagging about agentic AI is that the failure is not usually the model getting "tricked" in some abstract sense. Instead, it is a permission boundary or an allowlist that has a blind spot nobody tested against, sitting inside a system trusted with real customer data.

How to Protect Against AI Agent Vulnerabilities in Your Organization

• Audit External Data Sources: Review all public-facing forms and data entry points that feed into AI agents, including Web-to-Lead forms, contact submissions, and any widget that allows unauthenticated input into systems agents can access.
• Test Allowlist and Redaction Rules: Work with your security team to test URL redaction and domain allowlists against edge cases, including uncommon top-level domains, malformed URLs, and character-parsing quirks that might slip through filters.
• Monitor Agent Message Attribution: Ensure AI agents operating in communication platforms like Slack clearly indicate their identity and the workflow that triggered their message, making it harder for attackers to impersonate agents for phishing.
• Implement Confirmation Steps: Require explicit confirmation before agents take sensitive actions, such as sending messages to external channels or querying sensitive database tables.

The Troubling Timeline: History Repeating Itself

The parallels between SalesBleed and ForcedLeak are striking and concerning. In July 2025, researcher Sasi Levi at Noma Security disclosed ForcedLeak, a critical-severity flaw chain with a CVSS score of 9.4, that also ran through Agentforce's Web-to-Lead integration. ForcedLeak used the form's Description field to smuggle in a prompt injection, then exfiltrated CRM data to an old Salesforce-related domain that had expired and been resold for roughly $5.

Salesforce responded by rolling out Trusted URLs Enforcement for Agentforce and Einstein AI on September 8, 2025. Noma's findings went public on September 25, 2025. Exactly one year later, on September 24, 2026, Zenity Labs published research showing that the same control had been bypassed through edge cases the original fix did not anticipate. The public disclosure dates for both research chains land within 24 hours of each other on the calendar, one year apart.

Zenity Labs reported its findings to Salesforce on June 1, 2026. Salesforce's engineering team acknowledged the issues and said work was underway by June 17. The Trusted URLs hardening was confirmed complete on August 18, and Zenity verified the fix on August 19. Salesforce has confirmed all three issues are fixed and stated it has seen no evidence that any of the three flaws were exploited against real customers before the patches shipped.

What Does This Mean for Enterprise AI Agent Governance?

The SalesBleed disclosure reaches past Salesforce's customer base into a wider debate about how enterprises govern AI agents that read email, touch CRM records, and act inside Slack without a human checking every step. Unlike traditional software vulnerabilities, these flaws do not carry CVE numbers because Salesforce treats Agentforce as a hosted service it patches directly rather than shipping software customers install themselves. That distinction matters more than it sounds, because it means the security model depends entirely on Salesforce's ability to identify and patch edge cases before attackers find them.

The fact that the same entry point has been exploited twice in 14 months suggests that the underlying architectural challenge of securing AI agents against prompt injection and data exfiltration remains unsolved. As enterprises increasingly deploy agentic AI systems to handle sensitive business processes, the security community is still developing the defensive patterns and testing methodologies needed to catch these edge cases before they become public vulnerabilities.