Slack Replies Need a Named Initiator
Zenity showed how a poisoned public CRM lead could redirect an employee’s legitimate Agentforce request into fraudulent Slack messages. Injected instructions exploited link filtering, unapproved thread replies and missing initiator labelling.
Researchers verified link filtering on 19 August, initiator labelling on 20 August, and all corrections on 21 September 2026. This closed the demonstrated path by default; administrators can disable confirmation. The report establishes no malicious campaign.
Review deployed controls
- Inventory writes: direct messages, thread replies, channel posts and other systems. Inspect deployed customisations; testing a new tenant cannot establish an older workflow’s state.
- Keep approval meaningful: show destination and content, checked against the initiating task. Disabled confirmation needs an exception owner and review date.
- Identify the initiator. An agent’s sender name cannot confer authority; show recipients who initiated the action.
- Separate data from commands. Treat web forms, email, cases and customer records as untrusted input.
- Test current link controls: Markdown, redirects and unusual forms; obvious links are insufficient.
- Monitor: unusual threads, channel fan-out, task mismatches and repeated actions against the same customer record.
Salesforce’s guide distinguishes employee-channel access in the end user’s context from customer-facing agents needing additional configuration. It recommends minimum permissions and identity checks within sensitive actions. General guidance does not independently verify this demonstration.
BlackTree’s agent-boundary analysis applies here: public input, a trusted model and a workplace connector formed a path across three systems. Review the authority connecting them.
Sources
- Research, published 24 September; no visible publication time.
- Vendor guide; no visible publication date.
