Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing

{
  "signal_id": "b1fbf6ac-c57b-d975-b4e0-9ebe0fc9cf87",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-09-24T19:01:15+00:00",
  "company": {
    "name": "Salesforce",
    "domain": "salesforce.com"
  },
  "data": {
    "url": "https://www.theregister.com/security/2026/09/24/salesforce-agentforce-vulns-allowed-0-click-crm-data-theft-anonymous-phishing/5298958",
    "title": "Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing",
    "excerpt": "security 'SalesBleed' security flaws 'lead to very unexpected consequences' Security flaws in Salesforce Agentforce allowed poisoned leads to hijack its AI agents, silently steal CRM data without requiring a click, and send phishing messages under the agents’ identities. Zenity Labs uncovered the three vulnerabilities, collectively called SalesBleed, and reported them to Salesforce, which worked with the AI agent security provider to fix the issues. While these attack chains no longer work, Zenity co-founder and CTO Michael Bargury told The Register that the vulnerabilities highlight the difficulties in controlling what agents can access - and what happens if and when they bypass guardrails intended to limit that access. “The bigger lesson here is about what it takes to keep AI agents contained,” Bargury said. “The idea of secure-by-design remains essential but for agents it may no longer be enough. We can anticipate risks and build protections into an agent from the start, yet still miss edge cases and the different ways it might behave once it encounters the real world.” He added, the challenge of agent constraint is a “wider trend” that extends beyond SalesBleed. “We’ve seen it with the OpenAI-Hugging Face incident where the agents managed to escape the sandbox that was meant to contain them, and we’re starting to see these types of flaws more and more often ,” Bargury...",
    "product": "Agentforce",
    "summary": "Salesforce's Agentforce platform was found to have three vulnerabilities, collectively called 'SalesBleed', which could allow for zero-click CRM data theft and anonymous phishing attacks through its AI agents.",
    "planning": false,
    "image_url": "https://image.theregister.com/5223048.jpg?imageId=5223048&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683",
    "confidence": 1,
    "product_data": {
      "name": "Agentforce",
      "full_text": "Salesforce Agentforce",
      "fuzzy_match": false
    },
    "product_tags": [
      "online_technology",
      "general_technology",
      "future_tech",
      "data"
    ],
    "published_at": "2026-09-24T19:01:15Z",
    "vulnerability": "Three vulnerabilities, collectively called SalesBleed, allowed poisoned leads to hijack AI agents, silently steal CRM data without a click, and send phishing messages under the agents’ identities by bypassing Trusted URLs controls.",
    "article_sentence": "Security flaws in Salesforce Agentforce allowed poisoned leads to hijack its AI agents, silently steal CRM data without requiring a click, and send phishing messages under the agents’ identities."
  }
}

curl https://signals.autobound.ai/v1/signals/b1fbf6ac-c57b-d975-b4e0-9ebe0fc9cf87 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"salesforce.com","limit":20}'