Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSalesBleed was a September 2026 proof-of-concept disclosure about two Agentforce attack paths, not a publicly confirmed Salesforce data breach. Zenity Labs showed how hostile text in an ordinary CRM lead could influence an agent that later processed it—and how the agent’s existing permissions and connected capabilities could turn that influence into an external request or a Slack message. Salesforce reportedly remediated the paths Zenity tested. The deeper lesson is not that every agent can be compromised this way, but that untrusted business data must not be treated as instructions or as authorization.
What SalesBleed was—and what it was not
Zenity Labs published two SalesBleed research posts on September 24, 2026. They describe proof-of-concept vulnerability chains involving Salesforce Agentforce: one centered on indirect prompt injection through a lead and possible data exfiltration; the other on an Agentforce Slack action that could be steered into sending phishing content. The accounts describe security research, not an active campaign or confirmed theft of customer data in the wild.
As an Amazon Associate I earn from qualifying purchases.
The headline idea that SalesBleed “isn’t a Salesforce bug” needs qualification. The scenarios were not simply a model behaving badly in isolation: Zenity reported specific weaknesses in URL redaction and in the initial defaults of a Slack action. The demonstrated outcomes also depended on several pieces working together—untrusted input reaching an agent, the agent’s access to records or actions, and a capability that could cause an external request or send a message. Zenity says Salesforce fixed the reported paths.
Zenity called its first finding “zero-click,” saying it could pull sensitive account data “without ever logging in, or requiring the victim to click anything.” In this context, zero-click means no click, attachment opening, or link interaction was needed after an employee made an ordinary request to the agent. That request was still the trigger; the phrase does not mean the attack happened without any user activity.
#1 Best Overall
How the two proof-of-concept paths worked
| Path | How the agent was influenced | Capability that mattered | Reported outcome |
|---|---|---|---|
| Lead-to-external-request path | Instructions were hidden in a lead submitted through a public Web-to-Lead form. Later, an employee asked the agent to review leads; Zenity used the illustrative request, “check my latest leads and help me with the newest one.” | The CRM subagent could query leads and account records under permissions it already had. The proof of concept then used a URL and downstream image rendering or Slack link unfurling to trigger a DNS lookup to attacker-controlled infrastructure. | Information could be encoded in an outbound URL and exposed through the external request. Zenity says the Trusted URLs bypass it reported was fixed and this described chain no longer worked after remediation. |
| Slack reply path | A malicious lead could steer the agent toward sending phishing content in Slack; Zenity also described the possibility of an internal user abusing the agent identity. | The examined Reply to a Slack Thread action in the Slack Knowledge subagent initially lacked confirmation and invoking-user attribution found in other examined Slack write actions. |
Zenity says Salesforce added attribution and later required confirmation by default. This was a separate path from the URL-based exfiltration scenario. |
The first path did not require an attacker to break into the Salesforce tenant or gain new permissions in the proof of concept. The researcher says the relevant lead and account query access was already available to the same subagent. That is why a familiar CRM task can become a security boundary: the agent may read a record that an attacker can populate, then combine it with authority and tools intended for legitimate work.
Why ordinary business data becomes an agent security issue
Prompt injection is an attempt to make a model interpret hostile content as instructions rather than as data to analyze. A lead’s free-text field can look like routine business content to an employee while containing text intended to change what the agent does. The same trust problem can arise in other places an agent reads, including retrieved documents, external grounding sources, tool responses, and messages passed between agents.
Salesforce Architects’ “Trust for the Agentic Enterprise” guidance makes the boundary explicit: “Treat every external content source as untrusted: Salesforce records, retrieved documents, action outputs, inter-agent messages.” A record being stored inside a company’s CRM does not make its contents trustworthy if an outside person can submit or influence them.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe consequential risk comes from the combination of input exposure and capability. Reading untrusted leads is different from reading those leads while also having access to sensitive account information and a way to cause external fetches or write to Slack. A model’s apparent willingness to follow a request is not an authorization check; the controls around its running identity and connected actions determine what that request can actually do.
What Salesforce says customers must secure
Salesforce’s shared-responsibility guidance distinguishes the security of its AI infrastructure and platform from the controls customers configure around their agents. Customers remain responsible for agent permissions, defenses against prompt injection, trust between agents, monitoring, and compliance. Platform guardrails are one layer, not a substitute for secure system design.
Salesforce Developers’ “Design Security-Hardened Prompts” guidance recommends defining the model’s role, boundaries, and expected output. It also says: “Where untrusted or user-input data is included in the prompt, indicate that the data must not alter or override any the prompt instructions.” This is useful prompt hygiene, but wording alone cannot guarantee that hostile text will be ignored. Salesforce’s architecture guidance also emphasizes separating instructions from data and validating inputs at agent boundaries.
Rank #4
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
How to assess an Agentforce design
Use the SalesBleed paths to review the whole route from input to effect, rather than checking only whether a prompt mentions prompt injection. Salesforce’s architecture guidance supports layered controls; none of these checks by itself guarantees safety.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Input exposure: Identify whether public forms, inbound email, case descriptions, retrieved documents, or tool responses can reach the agent as free text. Treat externally populated fields as untrusted even after they are stored in CRM.
- Permission scope: Review which objects, fields, records, and actions the agent’s running identity can access. Limit that scope to the work the agent must perform; pay particular attention when the same agent can read externally influenced content and sensitive records.
- Egress and rendering: Trace whether model output can lead to external requests through URLs, images, previews, link unfurling, or connected integrations. Consider how each parser or renderer handles the output rather than assuming one URL control covers every path.
- Action safeguards: Identify which write actions require a person’s confirmation and whether recipients can see who initiated a message. Treat confirmation and attribution as checkpoints for sensitive actions, not as proof that the preceding reasoning was safe.
- Monitoring and audit: Ensure logs can connect the input record, agent actions, running identity, any confirmation, and the outcome. That chain matters when investigating whether unexpected behavior came from a hostile record, an agent decision, or an integration.
Where risky free text is not essential to the task, Salesforce’s architecture guidance also points to preprocessing or summarizing it before it reaches the agent. That can reduce exposure, but it does not remove the need to constrain permissions and validate behavior at system boundaries.
What the remediation timeline establishes
Zenity says it reported the findings to Salesforce on June 1, 2026, and Salesforce confirmed the next day that it was working on fixes. Zenity says it confirmed the Trusted URLs fix on August 19, Slack attribution on August 20, and all reported fixes by September 21. These dates are Zenity’s account of disclosure and validation, published alongside its posts on September 24; they are not an independent check of each customer’s tenant or configuration.
Salesforce had previously published a Help notice on September 27, 2025, requiring confirmation for two customer-contact actions as a precaution against prompt-injection risks. That notice is context for the value of confirmation on sensitive actions; it is not documentation of the 2026 SalesBleed Slack fix.
Organizations using Agentforce should check current Salesforce documentation and their own org’s release and action settings with their administrators. The researcher-reported fixes do not establish that every environment has the relevant feature enabled or configured as intended, and the available SalesBleed account provides no prevalence estimate or evidence of real-world exploitation.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
