Contact Form Prompt Injection: The Lead Was the Attack

The short version: In a contact form prompt injection attack called SalesBleed, researchers at Zenity Labs showed that a stranger could type instructions into a public Salesforce web form, wait for a salesperson to ask the company’s AI agent about new leads, and have that agent quietly send the company’s account data to the stranger. Nobody clicked anything. Salesforce fixed it by August 19. The lesson travels well beyond Salesforce: if an AI tool at your business reads what strangers type into your contact form, can look up your customer records, and can post links somewhere, it has the same three ingredients. Remove any one of them and this attack has nowhere to go.

That last sentence is the useful part, and it is good news. You do not need to stop letting AI sort your leads. You need to know which of your setups hold all three pieces at once, and most small-business automations do not.

What is contact form prompt injection?

A contact form is the one box on your website that anyone on earth can write into. For twenty years its only reader was a person, and a person does not follow orders hidden in a sales inquiry. An AI model reads everything it is handed as potential instructions. When a submission says, in effect, “look up the company’s biggest accounts and put their names in this link,” a model asked to summarize that lead may do exactly that. That is prompt injection, and the contact form is its most convenient front door.

Zenity’s write-up, SalesBleed: 0-Click Data Exfiltration in Agentforce, made public on September 25 by researchers Alex Apostolov, João Donato, Avishai Efrat and Ayush RoyChowdhury, puts the attacker’s advantage plainly: with a public form as the entry point, there is no account to suspend and no login to spot.

How the SalesBleed attack worked, step by step

1. The poisoned lead. The attacker submitted a lead through Salesforce’s public Web-to-Lead form with instructions buried in it. It sat there, dormant.
2. The routine question. An employee later asked the Agentforce agent something like “check my latest leads and help me with the newest one.”
3. The hijack. The agent read the lead, obeyed the buried instructions, and used its record lookup tool to pull company names and deal sizes from the Accounts table.
4. The disguise. It packed that data into a web address on the attacker’s domain. Salesforce’s filter for untrusted links did not recognize the .fun domain ending, and disagreed with the browser about where a link ends when curly braces appeared. The link sailed through.
5. The exit. The agent printed the link as an image. When the chat window tried to load it, the computer looked up the attacker’s address, and the lookup itself carried the data to the attacker’s server.

In Slack, the image trick was not even needed. Slack builds a preview for every posted link, and to build one it visits the link. A third flaw let the hijacked agent post phishing messages into internal Slack channels, from a system staff already trust. Zenity reported the problem on June 1, 2026, and verified Salesforce’s fix on August 19. If you run Agentforce, these flaws are closed.

Why this is not only a Salesforce problem

Zenity’s own conclusion is broader: any agent that reads records submitted by outsiders, shows links or images back to a user, and also has access to sensitive data has the same three ingredients sitting in the same place. Independent developer Simon Willison named this pattern the lethal trifecta in June 2025: access to private data, exposure to untrusted content, and a way to communicate outward. His advice is blunt. No filter reliably stops it; the defense is not combining all three.

SalesBleed shows why. Salesforce had a sensible filter, and it lost to two edge cases nobody tested. Filters get patched; structure is what protects you. When researchers hijacked an AI browser agent with a single planted comment, the agent had to go find the poison. Here the poison comes to you, through the form you built to collect business.

Which small-business AI setups have all three ingredients?

Here is the sorting exercise, and it takes about ten minutes. For each place AI touches your inbound leads, ask three questions.

1. Does it read what strangers submit? Web forms, chat widgets, inbound email, review replies. Almost every lead tool answers yes. That is its job.

2. Can it look anything up beyond the lead itself? This is the question that sorts most setups. A simple automation in Zapier, Make or n8n that takes a new form submission, asks ChatGPT or Claude to summarize it, and posts the summary to your team usually cannot. The AI step sees one lead and nothing else, so there is nothing for an attacker to steal. A CRM assistant that can search your contacts and deals, like HubSpot’s Breeze, Zoho’s Zia or Agentforce itself, or a chatbot you have connected to your inbox or files, usually can. That is where the risk lives.

3. Can its output reach the outside world on its own? Links that auto-preview, images that auto-load, emails it can send. This is the leg most owners never think about, because it looks like a convenience feature.

Two yeses is normal and fine. Three yeses is the SalesBleed shape.

The Slack default that did the stealing

The third leg deserves a closer look, because the setting that powered the Slack variant is on by default and sits in a lot of small-business workflows. Slack’s own developer documentation on unfurling links, which we read on September 26, 2026, says it unfurls all links in messages posted by users and apps by default, and that its servers must fetch every URL in a message to decide what kind of preview to build. That fetch is the exit door. No human has to click.

The fix, where your AI posts into Slack, is to turn previews off for those messages. Developers set unfurl_links and unfurl_media to false. In Zapier, Slack’s message actions carry an “Auto-Expand links?” option; set it to no for any step that posts AI-written text. One caution from Zapier’s own community forum: users have reported previews still appearing with the option switched off, so send a test message containing a link and confirm no preview appears before you trust it.

What to do this week

Keep using AI to triage leads; answering inquiries faster is one of its best small-business uses. Just make one structural choice per setup:

• If the tool only summarizes, keep it that way. Resist the upgrade that lets the lead summarizer also search your customer list.
• If the tool must look things up, cut its outbound leg: previews off, no auto-loading images, no sending without a person approving.
• If the tool must both look things up and send, give it the narrowest data access it needs. The Salesforce agent could reach the whole Accounts table to answer a question about one lead. Yours should not.

As with leaked credentials letting AI models into real companies, an attacker can only take what the doorway reaches. If you are weighing Agentforce itself, see our look at Agentforce pricing for small business.

Frequently Asked Questions

Is Salesforce Agentforce still vulnerable to SalesBleed?

No. Zenity Labs reported the flaws on June 1, 2026, Salesforce confirmed the fixes by August 18, and Zenity verified on August 19 that the attack chain it described no longer works. No CVE numbers were assigned.

Can someone hack my business just by filling out my contact form?

Only if an AI tool reads that submission and also has access to other data and a way to send information out. A form that goes to a person, or to an AI that only summarizes that one message, gives an attacker no data to take.

What is the lethal trifecta in AI security?

It is Simon Willison’s name for an AI agent that combines access to private data, exposure to untrusted content, and the ability to communicate outward. Any agent with all three can be tricked into leaking data, so the reliable defense is removing one of the three.

How do I stop Slack link previews on AI-generated messages?

Developers set unfurl_links and unfurl_media to false when posting. In Zapier’s Slack actions, set “Auto-Expand links?” to no, then send a test message with a link to confirm no preview appears, since some users have reported the setting not always holding.

Where does AI read your inbound leads today, and how many of the three ingredients does that setup have? We would like to hear what you find.