Your Contact Form Just Became an Attack Surface
Almost every business website has one. A simple form where a visitor types their name, email, company, and a short message. It feeds straight into the CRM so the sales team can follow up.
Last week, security researchers showed how that ordinary form could be used to quietly pull sensitive customer data out of a company’s CRM, without anyone clicking a link, opening an attachment, or logging in.
What the researchers found
Zenity Labs disclosed three vulnerabilities in Salesforce Agentforce, the AI agent layer built into Salesforce’s CRM. They named the set SalesBleed.
The attack started with a normal-looking lead submitted through a public web-to-lead form. Hidden inside the text fields were instructions written for the AI agent, not for a human. Those instructions sat dormant in the CRM like any other lead.
Then, at some point, an employee asked the agent something routine, such as “check my latest leads and help me with the newest one.” The agent read the poisoned lead, followed the hidden instructions, queried other CRM records, and sent that data to a server the attacker controlled. The data could include account names, contacts, deal sizes, and pricing, depending on what the agent had permission to read.
In one detail from the research, the agent reported that the content had been blocked by security policy, even though the data had already left.
A third flaw allowed the agent to post messages in Slack without clearly identifying who had asked it to, which opened the door to phishing messages that appeared to come from a trusted internal assistant.
Zenity reported the issues in June, and Salesforce has since fixed them.
Why this matters beyond Salesforce
It would be easy to read this as a Salesforce story and move on. The researchers were clear that it isn’t. The same weakness had surfaced in the same feature about fourteen months earlier, and the underlying pattern applies to any AI agent built with three characteristics:
- It reads content from outside the business. Form submissions, emails, support tickets, uploaded documents.
- It can access internal records. Customer data, pricing, contracts, pipeline.
- Its output appears somewhere links or images load automatically. A chat window, a Slack channel, a web dashboard.
When all three are present, anyone who can put text in front of the agent can potentially influence what it does with the data it can reach. That’s a new kind of risk, and it arrives through features businesses turn on precisely because they’re useful.
This is a configuration question more than a technology question
Most businesses adopting AI agents inside their CRM, help desk, or collaboration tools switch them on with default settings. That’s a reasonable thing to do. Defaults are designed to make the product work well out of the box.
What defaults don’t do is reflect your specific data, your specific public entry points, or how much access each agent actually needs. That part is a decision, and it’s usually never made explicitly.
A few questions go a long way:
- What can each agent read? If an agent only needs lead details, it shouldn’t be able to query every account and contract.
- Which inputs come from the public? Anything submitted through a website form, email, or ticket portal should be treated as untrusted, even after it lands in your own system.
- What can the agent do without a person confirming it? Sending messages, sharing links, or updating records on its own deserves a second look.
- Where does the agent’s output show up? If that surface automatically loads images or previews links, it can become a quiet path for data to leave.
Where to start
AI agents inside everyday business tools are going to keep getting more capable, and most businesses will benefit from using them. The ones that get the most out of that shift will be the ones that decided what their agents are allowed to touch, rather than inheriting whatever the default happened to be.
If your business has AI features switched on in its CRM, help desk, or collaboration tools and nobody has reviewed those permissions, that’s a sensible place to begin. One Request connects you with a specialist who can review exactly this across your environment.