SalesBleed. The access path.
A hijacked Agentforce agent phished Slack under its own trusted identity. An agent with a badge and no attribution is a better phishing identity than any lookalike domain.
The record
Entry point. public Web-to-Lead form, indirect prompt injection lying dormant in the CRM.
The identity in the middle. The agent own Slack identity. The reply action could post to channels without user confirmation and without visible attribution.
What was reached. Slack channels, phishing posted under the agent identity, with the real sender not identified.
A hijacked Agentforce agent phished Slack under its own trusted identity.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| public Web-to-Lead form | Entry | indirect prompt injection lying dormant in the CRM |
| employee query to Agentforce | Step | the dormant instructions activate during a normal question |
| Trusted URLs parsing | Step | the allowlist did not recognise top level domains and could be confused by character sequences |
| HTML image tags | Step | CRM data exfiltrated to an attacker server with no user interaction |
| Slack channels | Reached | phishing posted under the agent identity, with the real sender not identified |
Where a breakpoint would have been
The write action, not the read. Exfiltration channels get patched one at a time. An agent that can post to Slack as itself, unattributed and unconfirmed, is a standing capability. Requiring attribution and confirmation on agent write actions is the change that survives the next injection.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the SalesBleed incident?
The published path starts at public Web-to-Lead form, indirect prompt injection lying dormant in the CRM.
What did it reach?
The last step in the published path is Slack channels, phishing posted under the agent identity, with the real sender not identified.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.