SalesBleed: How Indirect Prompt Injection Could Turn Salesforce AI Agents Into a Data Exfiltration…

Sales teams, customer service organizations, marketing departments, and operations teams are increasingly using AI agents to search records, summarize information, communicate with customers, and perform actions across business systems.

This creates new opportunities for productivity, but it also introduces a security challenge that traditional application security controls were not designed to handle.

A recently disclosed group of Salesforce Agentforce vulnerabilities, referred to as SalesBleed, demonstrates how attackers can potentially manipulate AI agents through untrusted business data.

The reported research showed attack paths involving indirect prompt injection, external URL handling, CRM data access, and Slack integrations.

One particularly concerning scenario could allow sensitive CRM information to be exfiltrated without requiring a victim to click a malicious link or manually approve the data transfer.

The incident highlights an important lesson for organizations adopting AI agents:

Business data processed by an AI agent must be treated as an untrusted input source, not automatically trusted simply because it exists inside an enterprise platform.

What Is SalesBleed?

SalesBleed refers to a set of security weaknesses discovered in Salesforce Agentforce.

Security researchers from Zenity Labs reported the vulnerabilities to Salesforce and subsequently disclosed their findings publicly in September 2026.

The research demonstrated how an attacker could place malicious instructions inside information that an AI agent was expected to process.

The attack concept is known as indirect prompt injection.

Unlike a traditional prompt injection where an attacker directly interacts with an AI system, indirect prompt injection hides malicious instructions inside data that the AI agent later reads.

That data could come from sources such as:

• CRM records
• Emails
• Customer submissions
• Web forms
• Documents
• Knowledge bases
• Support tickets
• External websites
• Third party applications

When an AI agent processes the information, it may interpret the embedded instructions as part of the task it is performing.

This creates a fundamentally different security problem from conventional application input validation.

How a Public Web Form Can Become an AI Attack Vector

One of the reported attack paths involved Salesforce Web-to-Lead functionality.

Web-to-Lead allows organizations to collect information from public web forms and create lead records inside Salesforce.

The security challenge emerges when an AI agent later processes those records.

An attacker does not necessarily need direct access to the organization's Salesforce account.

Instead, malicious instructions can potentially be inserted into a publicly accessible form and stored as part of a lead record.

When an Agentforce agent later processes that record, the malicious content can become part of the agent's working context.

This creates a new type of attack chain:

Public input → CRM record → AI agent → privileged tools → sensitive data

The important security issue is not simply the public form.

It is the fact that information originating from an untrusted external party can eventually influence an AI system that has access to trusted enterprise resources.

Why Zero Click Data Exfiltration Is Concerning

Traditional phishing attacks often require a user to click a link, open an attachment, approve an action, or provide credentials.

The reported SalesBleed attack path demonstrates a different model.

A malicious instruction can remain dormant inside a CRM record until an AI agent processes that information.

If the agent has sufficient permissions and the relevant security controls can be bypassed, the attacker may be able to influence what the agent does without requiring a user to consciously approve the operation.

This is commonly described as a zero-click or no-user-interaction attack path.

The security significance is substantial.

A user could simply perform a normal business activity, such as asking an AI agent to summarize leads, while the underlying agent processes malicious content embedded in one of those records.

The employee may not realize that an attack is taking place.

Trusted URL Controls Are Part of the Security Boundary

The reported research also identified weaknesses involving Agentforce's handling of external URLs.

Security controls designed to restrict where AI agents can communicate or retrieve information are important because an AI agent with access to enterprise data may also have access to external resources.

If an attacker can manipulate how a URL is interpreted, validated, or sanitized, the agent may potentially be tricked into interacting with an external destination that should have been blocked.

This demonstrates why URL filtering for AI agents cannot rely solely on simple string matching.

Security controls need to understand:

• Hostnames
• Domains
• URL parsing
• Redirect behavior
• Encoded characters
• External destinations
• Allowlisted services
• Data being transmitted
• Agent generated requests

The destination itself is only one part of the security decision.

Organizations also need to understand what information the AI agent is permitted to send to that destination.

AI Agents Can Become High Privilege Application Components

Traditional software generally follows predefined instructions.

AI agents operate differently.

An agent can interpret natural language, retrieve information, select tools, and determine a sequence of actions based on the context it receives.

That flexibility creates an additional security boundary.

An Agentforce implementation may have access to:

• Customer records
• Account information
• Sales opportunities
• Contact details
• Internal knowledge
• Business processes
• Communication platforms
• External applications
• Enterprise APIs

If an attacker can influence the agent's instructions through untrusted data, the agent may become an unexpected bridge between an external attacker and sensitive enterprise systems.

This is why AI agents should be treated as production software components with their own security architecture.

The Slack Risk

The SalesBleed research also identified a separate Agentforce and Slack security issue involving the ability of an agent to reply to Slack threads.

The concern was not simply that an AI system could generate text.

The more important issue was that an agent could potentially send messages through a trusted communication platform without sufficient confirmation and attribution controls.

This creates a new phishing scenario.

Instead of receiving a suspicious message from an unknown account, an employee could potentially receive a malicious message that appears to originate from an organization's trusted AI agent.

The trusted identity of the agent could increase the credibility of the message.

This demonstrates why AI agent actions require strong authorization controls.

An AI system should not automatically receive permission to communicate externally simply because it has permission to read internal information.

Read Access and Write Access Are Different Risks

One of the most important lessons from AI agent security is that not all permissions carry the same risk.

An agent that can read customer information presents one type of risk.

An agent that can modify customer records presents another.

An agent that can send external communications creates another level of exposure.

Organizations should therefore distinguish between:

• Read permissions
• Write permissions
• Delete permissions
• External communication
• API access
• File access
• Administrative functions
• Financial actions
• Credential related operations

The principle of least privilege should apply to AI agents just as it does to human users and traditional applications.

Indirect Prompt Injection Is a Broader Enterprise Risk

SalesBleed is not only a Salesforce problem.

The underlying attack technique applies to many AI enabled systems.

An organization may have AI assistants connected to:

• Microsoft 365
• Slack
• Salesforce
• ServiceNow
• Jira
• GitHub
• SharePoint
• Customer support platforms
• Internal databases
• Data warehouses
• Cloud services

If those systems allow an AI agent to process external or user controlled content, that content may become a potential prompt injection carrier.

This creates a new enterprise security principle:

Data should not automatically be trusted simply because it is being processed inside a trusted application.

AI Security Requires More Than Prompt Filtering

Prompt injection detection is useful, but it should not be the only defense.

Salesforce itself provides prompt injection detection capabilities and additional security controls for AI applications.

Organizations should implement multiple layers of protection.

These can include:

Strong Input Validation

Untrusted CRM fields, forms, documents, emails, and external content should be treated as potentially malicious.

Least Privilege

AI agents should receive only the data and tools required to perform their intended tasks.

Human Confirmation

Sensitive actions should require explicit user confirmation wherever practical.

Tool Restrictions

Agents should not automatically have unrestricted access to APIs, databases, communication platforms, or external destinations.

URL Allowlisting

External destinations should be tightly controlled and continuously reviewed.

Data Loss Prevention

Organizations should monitor and restrict sensitive data leaving AI agent environments.

Runtime Monitoring

Agent activity should be monitored for unusual tool calls, data access patterns, external requests, and unexpected actions.

Detailed Logging

Organizations should maintain sufficient records to reconstruct what an AI agent received, what tools it invoked, what information it accessed, and what actions it performed.

AI Agent Security Should Be Included in Threat Modeling

Traditional threat modeling often focuses on users, APIs, databases, servers, and applications.

AI agents introduce another important component.

Security teams should ask:

• What data can influence the agent?
• Which sources are considered untrusted?
• What tools can the agent access?
• What data can each tool retrieve?
• Can the agent communicate externally?
• Can it modify enterprise records?
• Can it send messages?
• Can it access sensitive information?
• What happens if the agent receives malicious instructions?
• Is human approval required for high-risk actions?
• Can the agent be manipulated through retrieved content?

These questions should be answered before an AI agent is deployed into production.

Industries That Should Pay Attention

Financial Services and Banking

Banks, fintech organizations, payment providers, and financial institutions use CRM platforms to manage customer relationships, sales processes, support operations, and sensitive financial information.

COE Security can help assess AI enabled CRM environments, APIs, identity controls, data access permissions, integrations, and AI agent workflows to reduce the risk of unauthorized data access.

Healthcare

Healthcare organizations increasingly use CRM and AI technologies for patient engagement, customer service, scheduling, communications, and administrative workflows.

COE Security can help assess AI agent permissions, patient data handling, third party integrations, APIs, identity systems, and cloud environments while supporting HIPAA related security requirements.

Retail and E-commerce

Retail organizations use CRM systems to manage customer profiles, loyalty programs, sales opportunities, marketing campaigns, and customer service.

AI agents connected to these systems should be carefully assessed for data access, external communication, privacy, and prompt injection risks.

Manufacturing

Manufacturing organizations increasingly use CRM platforms and connected cloud applications to manage customers, distributors, suppliers, and enterprise operations.

COE Security can help evaluate AI integrations, APIs, cloud environments, identity controls, and application security across these digital ecosystems.

Government and Public Sector

Government organizations managing citizen services, communications, and public programs need strong controls around sensitive information and automated decision support.

COE Security can help assess AI applications, identity systems, cloud environments, APIs, data governance, and agent security controls.

Technology and SaaS

Technology companies and SaaS providers are rapidly integrating AI agents into enterprise workflows.

COE Security can help organizations perform AI security assessments, agentic application testing, API security testing, threat modeling, penetration testing, and secure architecture reviews.

What Organizations Should Do Now

Organizations deploying Salesforce Agentforce or other enterprise AI agents should take several practical steps.

Review AI agent permissions.

Identify exactly which records, APIs, applications, communication platforms, and external services each agent can access.

Audit external inputs.

Review public forms, email ingestion, support tickets, documents, and other sources that can introduce untrusted information into AI workflows.

Enable available security controls.

Review prompt injection detection, Trusted URL configurations, confirmation requirements, and other security controls provided by the platform.

Require confirmation for high impact actions.

AI agents should not independently perform sensitive operations simply because the underlying platform technically allows them.

Monitor outbound activity.

Watch for unusual external connections, unexpected destinations, suspicious data transfers, and anomalous agent behavior.

Implement AI specific logging.

Security teams need visibility into agent prompts, retrieved data, tool calls, actions, and external communications.

Perform AI red team testing.

Organizations should deliberately test whether malicious data can influence an agent to bypass its intended instructions or access information outside its authorized scope.

Conclusion

The SalesBleed findings demonstrate that enterprise AI security is becoming inseparable from traditional application security.

The risk does not necessarily begin with a malicious user directly interacting with an AI system.

An attacker may instead place malicious instructions inside information that the AI agent is expected to process.

If that agent has access to sensitive data and powerful tools, the consequences can extend beyond an incorrect AI response.

The incident highlights several important principles for organizations adopting agentic AI:

Untrusted data must remain untrusted.

AI agents should operate with least privilege.

Sensitive actions should require appropriate authorization.

External communications should be tightly controlled.

Agent activity should be monitored and auditable.

As enterprises connect AI agents to CRM platforms, communication systems, databases, APIs, and cloud services, the security architecture surrounding those agents must evolve at the same pace.

AI security is no longer only about protecting the model.

It is about protecting the entire ecosystem of data, tools, identities, integrations, permissions, and actions surrounding the model.

About COE Security

COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.

Our offerings include:

• AI-enhanced threat detection and real-time monitoring • Data governance aligned with GDPR, HIPAA, and PCI DSS • Secure model validation to guard against adversarial attacks • Customized training to embed AI security best practices • Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud) • Secure Software Development Consulting (SSDLC) • Customized CyberSecurity Services • Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.

In addition, COE Security helps organizations secure enterprise AI agents and AI enabled business applications through:

• AI security assessments and agentic AI security testing • Indirect prompt injection assessments • AI red teaming and adversarial testing • AI agent threat modeling • Agent permission and least privilege reviews • AI data access and authorization assessments • API and third party integration security testing • CRM and enterprise application security assessments • Data loss prevention and sensitive data exposure assessments • AI runtime monitoring and threat detection • Secure AI architecture reviews • Identity and Access Management assessments • Cloud security assessments • Application and API penetration testing • Secure AI pipeline and DevSecOps assessments • AI governance and compliance readiness assessments • Incident response planning for AI enabled environments

For financial services and banking organizations, we help secure CRM platforms, AI agents, APIs, customer data, authentication systems, payment environments, cloud infrastructure, and enterprise integrations.

For healthcare organizations, we help protect patient and customer information, CRM systems, AI applications, APIs, cloud environments, identity systems, and third party integrations while supporting regulatory requirements.

For retail and e-commerce organizations, we help secure customer data, loyalty platforms, CRM applications, AI assistants, APIs, payment environments, and digital customer experiences.

For manufacturing organizations, we help protect CRM platforms, enterprise applications, APIs, cloud environments, identity systems, connected technologies, and business data.

For government and public sector organizations, we help assess AI enabled services, CRM environments, APIs, identity systems, cloud infrastructure, data governance, and automated workflows.

For technology and SaaS organizations, we help secure AI agents, APIs, cloud applications, enterprise integrations, software development environments, and AI enabled products through security assessments, penetration testing, threat modeling, and AI red teaming.

Our goal is to help organizations identify security gaps, reduce AI and cyber risk, strengthen resilience, protect sensitive information, and maintain compliance as organizations increasingly integrate AI agents into critical business workflows.

Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption and to stay updated and cyber safe.