Zenity Labs disclosed a set of Salesforce Agentforce vulnerabilities called SalesBleed that demonstrate how an untrusted instruction can be transformed into an apparently trusted enterprise action.
One attack path began with malicious instructions submitted through public Web-to-Lead data. When an internal user later asked Agentforce to work with the lead, the agent could follow the embedded instructions. Researchers demonstrated zero-click CRM data-exfiltration paths and a Slack path in which the trusted agent could send phishing messages without the expected confirmation and attribution controls. Salesforce remediated the reported issues.
A trusted agent can become an authority-laundering intermediary
The important chain is not merely prompt injection.
It is external actor → public input → enterprise data → trusted AI agent → trusted internal action.
The final Slack message can carry the identity and credibility of the enterprise agent even though the causal instruction originated outside the organization.
A trusted agent cannot confer authority on an untrusted instruction simply by relaying it.
Preserve authority provenance across systems
Enterprise authority provenance needs to survive application boundaries, context transformations, subagent handoffs and tool calls.
The system should be able to identify the actual initiating principal and determine whether that principal possessed authority for the resulting effect.
Authentication can identify the agent that delivered an action. Authority must establish who was entitled to cause it.
Sources
https://labs.zenity.io/post/salesbleed-hijacking-agentforce-in-slack-for-anonymous-phishing
NEXT STEP