SalesBleed prompt injection: a public CRM lead reaches account data and Slack

Two SalesBleed reports from Zenity Labs, published on 24 September 2026, describe how an indirect prompt injection in a public CRM lead could reach Salesforce Agentforce account data and Slack. Alex Apostolov, João Donato, Avishai Efrat and Ayush RoyChowdhury are the authors. Salesforce remediated the reported chains, and Zenity confirmed the fixes. The work is a research demonstration with no CVE stated, and it establishes no customer breach or criminal exploitation.

A public form becomes an instruction source

Web-to-Lead endpoints accept leads from outside the organisation. They are public by design and unauthenticated: there is no account to suspend, no session to revoke and no login event to spot. An attacker can submit a lead whose fields carry hidden instructions.

The injection stays dormant until an employee does routine work. An employee asks their own agent to check the latest leads. The agent reads the lead as CRM data and follows the instructions inside it. The employee never clicks attacker content, which is what zero-click means here. Ordinary lead review still has to happen, and that request is the trigger.

Agentforce's default General CRM subagent held read access to both the Leads and Accounts tables, so the injection did not need to escalate privilege. The researchers describe the arrangement as a version of the lethal trifecta: untrusted content, private data and an outbound path held by one identity. In the demonstrated chain, the lead persisted in the Leads table and could execute again on each review.

When redaction and rendering disagree

Agentforce uses Salesforce's Trusted URLs mechanism to strip untrusted URLs from agent output. The researchers found that the redactor and the surfaces rendering the output disagreed about which hostnames count as URLs and where a URL ends. A malformed string the redactor treated as ordinary text still worked as a fetchable address downstream.

Redaction runs after the agent produces its output, and the agent does not know its text was edited. Every downstream renderer has to share the parser's URL grammar.

The exfiltration path used DNS. Sensitive values from the Accounts table were placed in the subdomain of an attacker-controlled hostname, so the lookup that precedes any web request carried the data to the attacker's authoritative nameserver. The HTTP request can fail or be blocked; the data has already left in the query. Egress controls that inspect only HTTP traffic can miss this path. Rendered image content in the chat surface and Slack's URL previews supplied the outbound trigger without user interaction. The prompt injection guide covers the wider class of attack, and the prompt injection examples collect related patterns.

One agent, two applications

The second SalesBleed report moves the same entry point into Slack. The researchers compared two write actions: Send a Slack Direct Message asked for user confirmation and named the invoker, while Reply to a Slack Thread, part of the default Slack Knowledge template, did neither in the tested configuration.

Missing confirmation removed the checkpoint before the message reached its audience. Missing attribution left recipients with the agent's identity and no visible record of who caused it. Combined with the URL redaction bypass, a phishing link could survive filtering and appear as a legitimate link in a thread with existing context.

The report separates two attacker models. An external attacker can use the poisoned lead route from the first report to make the agent post into Slack channels from an injection delivered through the CRM. A malicious insider needs only the ability to chat with the agent and use its Slack actions, and missing attribution hides the origin. Only the first involves indirect prompt injection; conflating the two overstates what each demonstrates.

A CRM input reached a Slack action because one agent held capabilities across both systems. Each added connector widens what one injected instruction can reach.

What the fixes cover

Zenity reported the findings to Salesforce on 1 June 2026. Salesforce confirmed the Trusted URLs redaction fixes on 18 August, and Zenity verified the specific bypass as fixed on 19 August. Reply to a Slack Thread gained correct invoker attribution on 20 August, and the researchers confirmed and tested all fixes on 21 September. According to the researchers, Salesforce's changes close the reported chains by default. No CVE was stated, and no customer breach or criminal exploitation was established.

Confirmation remains a configurable setting. Zenity notes that disabling it takes a single click and that the attack path can become available again. Turning confirmation off removes that checkpoint. It does not by itself restore every part of the original chain, which also depended on the URL redaction bypass that Salesforce fixed separately.

What security teams can check now

• Treat public form input as untrusted content. Leads, tickets and other externally submitted records can carry instructions into any agent that reads them.
• Review subagent tool scope. Check which tables and systems each agent identity can read. Sensitive read access plus an outbound trigger becomes a disclosure path.
• Align redaction with rendering. Verify that components removing untrusted links and components rendering output share one URL grammar, then test malformed forms.
• Watch DNS as an egress path. Data can leave in a lookup before any HTTP policy applies.
• Keep confirmation and attribution on write actions. One control interrupts an unintended action, and the other records who caused it.
• Constrain cross-application reach. Review each agent's connectors and published channels against the work it performs.

The SiYuan MCP case shows a related pattern in a different product: sensitive-file access remained possible even though the tool arguments, including the source path, were visible before approval. SalesBleed adds a public entry point and an outbound path.

Promptective applies organisation policy at supported AI interaction and action boundaries, with content-minimised decision evidence. The SalesBleed research establishes the pattern; it provides no product effectiveness measurement for Promptective.

Sources

• Zenity Labs, "SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce", published 24 September 2026.
• Zenity Labs, "SalesBleed: Hijacking Agentforce in Slack for Anonymous Phishing Attacks", published 24 September 2026.