Free tools Windows power users keep installed
One-click scans. No signup required.
SalesBleed shows why an AI agent’s general permission to use a tool is not the same as permission to use it for a particular request. In a Slack workflow, Zenity Labs reported that an agent could reply in a thread without confirming the action or making clear which user had triggered it; untrusted CRM content could also influence an agent’s later work. Salesforce said it fixed the reported paths before Zenity published its disclosure. The broader lesson is to keep roles as a ceiling, then constrain each task’s resources, operations and duration at the point where tools access data or take action.
What SalesBleed demonstrated
Zenity Labs published its Slack-focused SalesBleed disclosure on September 24, 2026. It described a default Slack Knowledge subagent template with a “Reply to a Slack Thread” action that, before remediation, did not require user confirmation and did not show other users who initiated the action. The report also described a URL-redaction bypass that could leave phishing links in messages. Zenity Labs’ disclosure says malicious instructions could be placed in CRM data—for example, through a Web-to-Lead form—and encountered later when an agent handled an otherwise benign lead-review request.
As an Amazon Associate I earn from qualifying purchases.
Why the Slack action mattered
Zenity distinguished the vulnerable thread-reply action from “Send a Slack Direct Message”: in its testing, the direct-message action asked for confirmation and identified the invoking user, while the thread-reply action did neither. Confirmation gives a person a chance to stop an unexpected external write. Attribution lets recipients understand whose request led to an agent’s message and whom to contact about it. These safeguards address different problems: approval can prevent a mistaken action, while attribution supports accountability after an action occurs.
Recommended Free Tools
What the disclosure does—and does not—establish
Zenity said Salesforce confirmed and tested fixes for all reported issues on September 21, 2026, before the public disclosure. That supports saying the reported paths were remediated; it does not establish an affected product-version range, guarantee that every tenant has the same configuration, or show that the issue was exploited in production.
#1 Best Overall
SalesBleed is also used to describe a separate CRM data-exfiltration chain. In a vendor-authored explanation, Tenuo describes a poisoned lead, an Accounts query and data placed in a URL hostname, and says Salesforce patched a URL-parsing bug. That account is useful for understanding authorization design, but it is distinct from the Slack findings in Zenity’s report and should be attributed to Tenuo’s explanation, not treated as a detail independently established by Zenity’s Slack disclosure.
Why a role can still leave an agent too much authority
A role or identity answers questions such as who is calling and which capabilities are generally available. It may not say which record the current user asked the agent to handle, whether the agent should read or change that record, or how long the authority should last. An agent can therefore have legitimate standing access and still choose an action that exceeds the purpose of the current request.
Tenuo calls the gap between conversational intent and what an enforcement point can verify “shadow delegation.” That is the vendor’s framing, not a standard term established by the incident report. Its architectural point is that intent kept only in a prompt or conversation is not a reliable access-control boundary. The tool or data layer needs to enforce verifiable limits even if untrusted content changes the agent’s plan.
| Control approach | What it can constrain | What it may leave open |
|---|---|---|
| Role-based access | A user or agent’s general capability ceiling, such as which tools or data categories are available. | The particular records, operation and time window needed for this request, unless those are separately checked. |
| Task-scoped authorization | The resources and operations allowed for a specific execution, optionally with a time limit and revocation. | A mistaken scope, flawed policy, prompt injection, or a harmful action that is still allowed by the grant. |
| Confirmation and attribution | Whether a consequential action receives human review and whether its initiating user is visible to recipients or investigators. | Neither control by itself limits every read or tool call to the task’s necessary resources. |
The approaches complement each other. Roles can set the maximum authority an agent should ever have; task-level checks narrow that authority for a particular run. A short-lived grant is useful only if its resource and operation limits are correct, and if downstream tools actually enforce them.
What to scope to an agent task
For each task, define the narrowest grant that still lets the agent complete the user’s request. A practical policy should answer:
- Which resources? Name the specific record or set of records the task requires, rather than making all records in a system reachable by default.
- Which operations? Separate reading, editing, sending, deleting and exporting. A read can expose sensitive data or enable exfiltration; “read-only” is not automatically safe.
- For how long? Set an expiry appropriate to the task, and provide a way to revoke authority when a run is cancelled or its context changes.
- Which destination? For messages, exports and other outbound actions, constrain where information can go as well as what the agent can retrieve.
- Can delegated tools widen access? Pass subagents and tools only the authority they need, never a broader grant than the parent task has.
- Where is the decision enforced and recorded? Check and log authorization at the tool or data boundary, not solely in prompt instructions or output filtering.
Tenuo illustrates the idea with a warrant allowing a query of one Lead record for 60 seconds while denying a query across all Accounts. This is an example from a vendor’s description of its design, not a universal standard or proof that a particular implementation is secure. The important property is that an unauthorized resource or operation becomes unavailable at the enforcement boundary, even if the model is persuaded to attempt it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Controls to keep around sensitive actions
Treat incoming business content as untrusted
Public forms, CRM fields, documents and messages can contain instructions written by people other than the employee who later asks an agent to process them. Treat that content as data, not as authority to change the task or grant access. Test whether an agent can be induced to follow embedded instructions when it summarizes or acts on a record.
Separate reading from writing
Give agents distinct read and write paths. Require confirmation for consequential writes where appropriate, especially messages or changes that affect other people. Confirmation is a review opportunity, not a substitute for limiting which records and destinations are available.
Keep the human initiator traceable
Preserve the initiating user’s identity through an agent action and make attribution visible where recipients need it. This is different from showing only that an automated system sent a message: the operational question is whose request caused that action.
Test the whole route, not just the prompt
Exercise the path from untrusted input through the model, any subagent, data access and final destination. Verify that tool calls outside the task’s allowed records or operations are denied, that approvals appear before the intended sensitive actions, and that logs preserve attribution. A policy written in natural language is not evidence that the system enforces it.
How common are agent-scope problems?
A Cloud Security Alliance survey published April 16, 2026, reported that 53% of surveyed organizations had experienced AI agents exceeding intended permissions and 47% reported an AI-agent security incident in the preceding year. The survey received 445 responses from IT and security professionals at organizations of varying sizes and locations. It was conducted online in September and November 2025 and commissioned and financed by Zenity, which co-developed the questionnaire. These are survey findings with that methodology and sponsorship, not a universal prevalence rate for all organizations. Cloud Security Alliance survey announcement.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
