Treat inbound lead text as untrusted when AI can write your CRM

Inbound lead text is untrusted when an agent can act on it.

Zenity Labs published SalesBleed about Sep 24, 2026. SecurityWeek covered it Sep 25. Poisoned Salesforce Web-to-Lead text could trigger indirect prompt injection against Agentforce, query CRM records, and exfiltrate data without a click. Zenity reported June 1. Salesforce fixed by about Aug 19. Treat that as a receipt for Signals, not a vendor roast.

Inbound lead text is untrusted when an agent can act on it. Scope tools and confirm outbound, or a form field becomes an exfil path.

Why is a lead form a trust boundary now?

Because AI as operator means the system can change state after it reads free text.

Web-to-Lead exists to take anonymous input. That is the point. When an agent later summarizes "latest leads," that free text becomes instructions mixed with data. Old CRM hygiene treated weird lead notes as spam. Agentic CRM treats weird lead notes as possible commands.

You do not need a novel exploit in your stack for the lesson to apply. Any agent that can read lead fields and call tools inherits the same boundary problem.

What does this change in Signals?

Signals is where you decide what the agent may notice and what it may touch.

Website de-anon (Vector, RB2B), G2 category traffic, competitor LinkedIn engagement. Those are inputs. Enrichment and CRM writes are outputs. If inbound form text sits in the same pipeline with open tool scopes, every submission is a potential prompt, not just a contact.

Ehrenberg-Bass / LinkedIn B2B Institute: about 95% of B2B buyers are not in-market. Most form fills are noise. Noise plus agent write access is how you get spam in the database and burn on the domain. Same law as write permissions: least privilege by default.

What rails belong on inbound text?

Four non-negotiables before you let an agent "help with new leads."

1. Treat form fields as hostile input. Company, title, notes, URL fields. Strip or quarantine instructions that look like tool calls. Do not pass raw lead notes into an agent with Query Records style tools open.
2. Least privilege on CRM tools. Agent can draft a summary. Agent cannot query Accounts, export lists, or render outbound URLs from lead text without an allowlist. Same family as permissions for write agents.
3. Outbound confirmation. Any message, Slack post, email, or webhook that leaves your tenant needs a human gate or a hard allowlist. Same spirit as a kill-switch for outbound.
4. Audit the read path. Log which lead the agent touched, which tools it called, and what left the system. If you cannot reconstruct it in five minutes, you cannot defend it.

How does disclosure fit?

Same law as human handoff disclosure.

If an agent acted on a poisoned lead and a human cleaned CRM or revoked a token, put that in the note. Do not hide it behind "AI resolved." Buyers already assume AI sits in the stack. What they punish is silent damage that shows up later as a wrong account, a phishing-looking Slack from "your agent," or a data leak.

Salesforce still puts about 27% of reps at quota. An agent that exfils or poisons the other 73% of workflows does not speed GTM. It becomes a liability with a logo.

How do I pressure-test this week?

Pull ten agent runs that touched inbound leads or Web-to-Lead style rows.

Ask: did the agent get raw notes? Which tools were in scope? Could it fetch other objects? Could it send or render a URL without a human? Is there an audit row?

If three of ten fail, freeze agent tools on inbound until you quarantine form text and tighten scopes. Keep scoring and draft summaries. Reopen tools one at a time.

Would you rather an agent that drafts a lead brief with no CRM query rights, or an agent that "helped with the newest lead" and also helped someone else read your Accounts table?

Adapt or fail. Untrusted input. Scoped tools. Confirmed outbound. That is the Signals boundary when AI can write your CRM.

Start Signals, Convert, Grow

FAQ

Is this only a Salesforce Agentforce problem?

No. SalesBleed is the receipt. Any stack where unauthenticated form text meets an agent with CRM tools has the same class of risk.

Should I turn off Web-to-Lead?

Not necessarily. Quarantine and scope first. Keep collecting leads. Stop treating lead notes as trusted instructions for an agent with open tools.

What is the minimum safe agent scope on inbound?

Read a sanitized lead summary. Draft a suggested next step. No cross-object query. No send. No URL render from the lead body. Expand only after you have logs and a kill path.

How does this fit Signals, Convert, Grow?

Signals owns what may enter and what the agent may notice. Convert owns what you say once trust is intact. Grow owns scale. An unscoped inbound agent scales the blast radius, not the pipeline.