Researchers reported three flaws in Salesforce's AI agent platform on June 1, and Salesforce confirmed all three were fixed by September 21.

 

What happened

Three security flaws in Salesforce Agentforce, collectively named SalesBleed, allowed a poisoned web form submission to take control of the platform's AI agents, pull customer records out of the system without anyone clicking anything, and send phishing messages carrying the agent's own identity, The Register reported on September 24, 2026. Researchers disclosed them to Salesforce on June 1, and the company confirmed the following day that it was working on fixes. The first fix was verified on August 19 and the remaining two on September 21. None of the attack chains work now. Agentforce is Salesforce's platform for AI agents that read and act on records inside its customer relationship management system.

 

Going deeper

The attack starts at a form anyone on the internet can fill in. Salesforce's Web-to-Lead feature lets organizations publish a form that writes enquiries straight into the CRM as sales leads, and an attacker used it to plant hidden instructions inside one of those records. The instructions sat dormant. They activated only when an employee later asked the AI agent something ordinary, such as to check the latest leads. At that point, the agent read the poisoned record and followed the instructions it contained, querying the accounts table, pulling out fields such as a company name and a deal size, and writing those values into a web address belonging to the attacker. The agent then displayed that address back to the employee inside an image tag, which caused the browser to fetch it automatically and deliver the data to the attacker's server. The employee saw nothing.

 

What was said

"Any agent that reads records submitted by external sources, renders links or images back to a user, and also holds tool access to sensitive data, has the same three ingredients sitting in the same place," the researchers wrote in findings covered by The Register. They noted that Salesforce closed this particular chain while the underlying pattern is not specific to Salesforce.

 

In the know

Two of the three flaws reached further through Slack. Slack automatically fetches information from links posted in conversations so it can display a preview, and researchers found that specially built links caused it to send customer data to attacker infrastructure the moment those links appeared, according to The Register. No one had to click. The third flaw involved an Agentforce action for replying to a Slack thread, which sent messages without asking the user to approve them and without showing whose request had triggered the agent. Someone inside the organization could therefore send phishing messages carrying the agent's identity while staying anonymous, and an outside attacker could achieve the same result through a poisoned lead.

 

The big picture

Healthcare organizations run the same three ingredients in combination. Patient enquiry forms, referral submissions, and portal messages all write externally supplied text into systems, and AI tools increasingly read those systems while holding access to patient records. Microsoft's recommendation for a related technique is to clean text before any system processes it, stripping or converting characters that do not display, and to apply that step before content reaches an AI model rather than afterwards, in research published this month. NIST is building AI-specific guidance on top of its existing cybersecurity framework, with securing AI systems as one of three areas covered in the preliminary draft of its Cyber AI Profile. The practical question for a covered entity is narrower than either document: which AI tools read records that outside parties can write into, and what can those tools reach once they have read them.

 

FAQs

What is indirect prompt injection?

Instructions hidden inside content an AI system will read later, rather than typed at the system directly. The attacker never interacts with the AI. They leave the instructions somewhere the AI will eventually encounter them, which in this case was a form submission stored as a record.

 

Why does an image tag cause data to leave?

Browsers fetch images automatically when a page loads. An address that carries stolen data inside it triggers a request to the attacker's server the moment the browser tries to display the image, without anyone clicking.

 

What was the Trusted URLs control meant to do?

Restrict which external destinations Agentforce could reach and hide links or images pointing anywhere untrusted. Researchers found it failed to recognize addresses ending in unusual domain endings, and that certain characters confused how it read a web address.

 

Should an organization stop AI agents reading externally submitted records?

Not necessarily, since that is often the purpose. The controls sit around it: limiting what the agent can query once it has read the record, requiring confirmation before it acts on anything, and restricting where it can send data.

 

How would this appear in logs?

As ordinary agent activity, because the queries the agent ran were ones it was authorized to run. Detection depends on watching where data goes rather than on whether a query was permitted, which is why outbound destination monitoring matters for agent deployments.