Your employees have been trained not to click suspicious links in email. They have learned to pause before acting on an urgent wire transfer request. But what happens when the phishing message arrives from a trusted AI assistant inside your own Slack workspace, speaking in its usual helpful tone? A set of vulnerabilities disclosed this week by Zenity Labs shows exactly how that scenario becomes real, and why organizations that rely on AI-powered CRM tools need to rethink their business email compromise defences now.
The stakes are not theoretical. The human layer of cybersecurity remains the most exploited surface in enterprise environments, and attackers are now building tools that weaponize the very systems employees are conditioned to trust.
What the SalesBleed Vulnerabilities Do
Zenity Labs publicly disclosed three security flaws in Salesforce Agentforce on September 24, 2026, giving the set the collective name “SalesBleed.” Two of the flaws enable zero-click exfiltration of CRM data, allowing an attacker to pull sensitive sales records, contact details, and deal information without any employee needing to take an action. The third flaw is the one that changes the threat landscape: it allows an attacker to hijack an Agentforce AI agent’s identity and send phishing messages inside a company’s Slack workspace, while remaining completely anonymous.
The attack entry point is the Web-to-Lead form, a standard Salesforce feature left open to capture inbound inquiries. An attacker poisons the form with a prompt injection payload. Once an employee processes the compromised lead, the agent executes the injected instructions and posts phishing content under the agent’s own trusted identity. Salesforce received the disclosure on June 1, 2026, patched within roughly two weeks, and has confirmed no evidence of in-the-wild exploitation before the fix shipped. Organizations should still verify their instances are current and Trusted URLs configurations reviewed.
Why This Is a Business Email Compromise Problem
Traditional business email compromise works because attackers impersonate someone the target trusts: a CEO, a finance director, a vendor. The defence has always been to verify unexpected requests through an out-of-band channel. SalesBleed-style attacks are harder to catch because the impersonated entity is not a person. It is a software tool that employees are already conditioned to follow without friction.
When an AI agent that routinely surfaces deal updates and meeting summaries also sends a message asking someone to approve a payment, re-enter their credentials, or forward a sensitive document, there is no ingrained instinct telling the employee to stop and call back to verify. The Verizon 2026 Data Breach Investigations Report found that the human element was involved in 62 percent of breaches, a figure that has held steady for years. SalesBleed is a reminder that the human element does not change, but the context around it evolves quickly, and security awareness training needs to evolve with it.
Canadian Organizations Face Real Exposure
Salesforce is one of the most widely deployed CRM platforms in Canada, used by enterprises, Crown-adjacent bodies, and nonprofits managing donor relationships and grant tracking. Canadian nonprofits are particularly exposed because they tend to operate with lean IT teams and limited security awareness budgets, and their public-facing Web-to-Lead forms are often used for fundraising campaigns that run for months without review. POPP3R’s Security101 program for Canadian nonprofits addresses exactly this gap, providing structured awareness training scaled to organizations that cannot afford enterprise security stacks but face the same adversaries.
The finance and operations teams that process inbound Salesforce leads, regardless of sector, are the most direct targets here. Any organization that has not audited who processes Web-to-Lead submissions or reviewed what actions its Agentforce configurations can take should treat this disclosure as a prompt to do so this week.
What to Do Before the End of the Week
Confirm your Salesforce instance is on a current release and that your Trusted URLs configuration has been reviewed with your administrator. Update your security awareness training to include AI-agent-delivered phishing: employees need to understand that a message from an internal AI tool can be manipulated, just as a spoofed email can. Show employees what a prompt-injected message might look like, and make clear that any unexpected request for credentials, approvals, or financial action from an AI tool warrants the same scepticism as an email from an unfamiliar address.
In our work with Canadian finance and executive teams, we consistently see that the highest-value targets receive the least training, because nobody wants to make the CEO sit through a 20-minute module. This is exactly the gap that incidents like the one above exploit.
Finally, invest in your reporting culture. The Verizon 2026 DBIR makes clear that how quickly an organization detects and reports a compromise matters more than whether someone was deceived. If you are unsure whether your organization is ready for this kind of threat, speak with our team to assess where you stand.
Sources
- Zenity Labs / BusinessWire: “Zenity Labs Uncovers SalesBleed, 3 Salesforce Agentforce Flaws Enabling Zero-Click CRM Data Theft and AI Agent Impersonation,” September 24, 2026
- The Register: “Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing,” September 24, 2026
- Verizon: 2026 Data Breach Investigations Report
- FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (Business Email Compromise data)
