Salesforce Agentforce SalesBleed: Three Flaws Enabled Zero-Click CRM Data Theft and Slack Phishing

Zenity Labs has disclosed three critical vulnerabilities in Salesforce Agentforce that allowed attackers to plant malicious instructions in public Web-to-Lead forms and trigger automated data exfiltration and phishing attacks through Slack, requiring zero user interaction and no attacker credentials. Researchers dubbed the vulnerability class SalesBleed, unveiling on September 24, 2026 the attack mechanics that Salesforce had quietly fixed in August following responsible disclosure on June 1.