Redbot Labs / Threat Intelligence
SalesBleed Research Shows Salesforce Agentforce Hijacking for Trusted Slack Phishing
- Incident ID
- RBT-TI-0102
- Organization
- Salesforce / Slack
- Reported Location
- San Francisco, California, United States — Vendor Location; No Victim Location Disclosed
- Severity
- High
- Category
- Indirect Prompt Injection / AI Agent Impersonation / Internal Phishing
- Record Date
- 2026-09-24
Incident Summary
Trusted-agent phishing. Zenity demonstrated that attackers could manipulate Salesforce Agentforce into posting phishing messages through its Slack identity.
External entry point. Malicious instructions placed in a CRM lead could redirect the agent when an employee later requested legitimate assistance.
What Happened
Injected business data. An attacker could submit instructions through a public Web-to-Lead form.
Missing action safeguards. The affected Slack thread-reply action lacked default confirmation and attribution to the initiating user.
Link-filter bypass. A separate URL-redaction weakness allowed crafted phishing links to survive filtering.
Remediation confirmed. Zenity reported that all fixes were tested and confirmed on September 21, closing the described default attack path.
Affected Systems
Agentforce CRM Processing / Slack Thread Replies / URL Redaction / Action Confirmation and Attribution
Attack Vector
Malicious CRM Lead / Indirect Prompt Injection / Agent-Identity Abuse / Phishing Link Delivery
Business Impact
Credible internal messages. Phishing content could appear under a familiar agent identity inside existing workplace conversations.
Evidence limits. The research does not establish affected-customer counts, stolen credentials, or financial losses.
These findings and remediation details come from Zenity’s technical disclosure.
Redbot Analysis
Business records can carry hostile instructions. Redbot Labs assesses that externally submitted CRM content should remain untrusted even after it enters an internal system. Storage inside a trusted application does not make the content authoritative.
Connected tools extend the consequences. An agent reading sales information may also hold permission to communicate with employees. Testing should examine whether instructions encountered in one system can trigger unauthorized actions in another.
Messages need accountable origins. Agent-generated communications should identify the responsible requester and retain an auditable connection to the initiating task. Consequential write actions should require appropriate authorization.
Validate configurations after deployment. Secure defaults can be weakened through later customization. Periodic testing should verify that confirmation requirements, destination controls, and action permissions still match the organization’s intended workflow.
