SalesBleed silently steals your CRM
Did you know your CRM can leak data without anyone clicking on anything?
Agentforce had a vulnerability that silently drained customer data.
Salesforce’s artificial intelligence platform allows anyone to submit a public lead capture form and slip malicious instructions inside it — no authentication or prior permission required.
Those instructions lie dormant in the CRM until an employee activates the agent with a routine question, triggering the exfiltration of account data.
The attack requires no active victim and no stolen password.
It all starts with a Web-to-Lead form that any company exposes to capture prospects. An attacker fills out that form with hidden instructions embedded in an apparently harmless field, and Agentforce stores them as a legitimate lead. When a sales rep asks the agent to review their contacts, the payload activates: the CRM sub-agent extracts account names and revenue figures, then encodes them into a subdomain controlled by the attacker.
The data leaves before anyone opens any link.
When Agentforce’s chat renders that image, the browser resolves the domain name. At that instant, the DNS query reaches the attacker’s server with the encoded data — no visible HTTP request. The theft is already complete. In deployments integrated with Slack, automatic link previews triggered the same DNS resolution without the user touching anything at all.
A single malicious form can be reactivated over and over again, indefinitely.
The poisoned lead remains in the CRM as long as no one removes it, turning every routine employee query into a new silent exfiltration. Salesforce has strengthened its Trusted URL lists and updated the Agentforce configuration in Slack to require explicit user confirmation before executing any action.
This case is not unique to Salesforce.
Any AI platform with access to corporate data and the ability to make external requests shares this same attack surface.
Agents inherit broad permissions and execute instructions without distinguishing their true origin.
The potential impact spans accounts, contacts, and entire pipelines — in mid-sized companies, that can mean thousands of records exposed at once.
Leaking data doesn’t always require exploiting a complex vulnerability.
SalesBleed demonstrates that all it takes is combining an open form, an agent with broad permissions, and a legitimate outbound channel like DNS to exfiltrate data without raising any alarms. And that opens a broader conversation about how these systems are configured.
Outbound filtering alone is not enough.
Salesforce attempted to block malicious URLs using its Trusted URLs mechanism, but researchers bypassed the filter by combining a domain unknown to the redactor with specific termination characters. The system deemed it malformed and let it through, while the browser resolved the name regardless. This bypass demonstrates that relying solely on outbound filtering leaves any AI architecture that processes external content exposed.
The prompt injection never needed to escalate privileges at any point.
The attack abused the permissions the CRM sub-agent already had assigned by design. There was no escalation, no classic lateral movement: the agent did what it was authorized to do, but following instructions injected by an external third party. That makes least-privilege permission configuration the most critical defense.
The persistence of the infected lead multiplies the real risk.
Unlike a one-time attack, here the payload lives in the CRM until someone removes it. Every routine query from an employee can reactivate it, turning a single malicious form into a continuous source of silent exfiltration.
Salesforce has not yet detected active exploitation.
The company confirmed it has strengthened the affected mechanisms and updated default configurations in Agentforce for Slack. At this time there is no evidence of in-the-wild exploitation, but the window between the discovery of a technique and its adoption by malicious actors is usually very short.
Audit your agents’ permissions now.
If your company uses Agentforce or another similar platform with access to customer data, audit which objects the agent can query and which outbound channels are enabled.
What you can do
- ✓Limit the CRM objects your AI agent can query.
- ✓Enable user confirmation for Agentforce actions in Slack.
- ✓Review stored leads and delete records with suspicious content.
Do you really know what data your AI agent can see and send?
Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.
Related articles
Zero-day exposes Cisco ISE
Does your network decide who gets in and who doesn’t based on the rules you set?
Zimbra caught in Russian espionage
Do you know if your corporate email is being emptied right now by Russian spies?
Shodan scans you without you noticing
Did you know someone can map your network without sending you a single packet?
ShinyHunters raids Cl0p
Did you know that malware can make decisions without any human giving the order?
eMAPT Conquers Mobile
eMAPT, the INE certification that validates professional penetration testing on Android and iOS mobile applications.
Nacata Security, reach out to us anytime
We are Nacata Security, get to know us
web: nacata.io
email: info@nacata.io
Phone: 919930793
LinkedIn: Nacata Security
Risks and attacks happening right now: vulnerabilities being actively exploited, official alerts from cybersecurity agencies, ongoing phishing or malware campaigns.
Information meant to help you act and protect yourself before the problem reaches you.
RATING
8.9
Who are we?
At Nacata Security we are an offensive cybersecurity company specialized in audits and penetration testing.
We detect, assess and help mitigate the vulnerabilities of your systems, networks and applications before a real attacker exploits them, offering 360º defense tailored to each client.
We’d be glad to get in touch with you for whatever you need.