Salesbleed: Agentic AI Exploits Salesforce to Smuggle Phishing Instructions into Slack

Dark Reading reports that a newly identified issue, tracked under the working name "Salesbleed," exploits the integration between Salesforce Agentic AI and Slack to facilitate cross-app phishing attacks. The vulnerability stems from the way Agentic AI systems process and transmit instructions from external web sources into internal communication channels. By manipulating these data flows, attackers can inject arbitrary instructions that are then rendered as trusted messages within Slack, bypassing typical user suspicion directed at external links or messages.

The mechanism relies on the trust relationship established between Salesforce Agent integrations and Slack workspaces. When an agent processes a web instruction, that instruction can be routed into Slack channels where it is displayed as a legitimate internal communication. Recipients, believing the message to be from a trusted colleague or system, are more likely to engage with embedded links or requests for credentials.

While specific exploitation details and active campaign activity remain under investigation, the reported vector highlights a growing attack surface at the intersection of agentic AI, CRM platforms, and workplace collaboration tools. The impact could include unauthorized access to sensitive data, credential compromise, and lateral movement within corporate networks.

Salesforce and Slack security teams are reportedly reviewing the findings. Security experts recommend that organizations using Agentic AI integrations audit trust boundaries, enforce strict input validation for cross-app data flows, and monitor for anomalous communication patterns within Slack workspaces.