SalesBleed consists of three vulnerabilities in Salesforce Agentforce discovered by Zenity Labs. Two flaws stem from weaknesses in the Trusted URLs security mechanism, which failed to properly validate top-level domains and URL parsing, allowing malicious Web-to-Lead form payloads to trigger zero-click exfiltration of CRM data to attacker-controlled servers. The third vulnerability involves the Agentforce-Slack integration, where specially crafted links in Slack cause automatic requests leaking CRM data and enable attackers to hijack the Agentforce agent to send phishing messages to internal Slack channels. These phishing messages appear to come from a trusted internal system, increasing the likelihood of credential theft. Salesforce confirmed all three vulnerabilities were addressed by August 19, 2026.

Attackers could hijack trusted Agentforce agents to exfiltrate sensitive CRM data without user interaction (zero-click), bypassing security policies. The flaws also allowed attackers to weaponize the Agentforce agent to send phishing messages within Slack channels, impersonating trusted internal systems. Successful phishing could lead to credential compromise and further access to enterprise resources such as email, Slack, and source code repositories.

Salesforce confirmed that all three SalesBleed vulnerabilities were fixed by August 19, 2026. Organizations using Salesforce Agentforce should ensure they have applied the official patches or updates released by Salesforce. No additional mitigation actions are required beyond applying these fixes.