The Agentforce inbound lead-generation agent: turning anonymous website visitors into booked meetings

Most of the traffic on your website is anonymous, and most of it leaves. Someone lands on the pricing page, has one specific question, doesn’t find the answer in ten seconds, and closes the tab. The form asks for eight fields and a phone number to “request a demo,” which is a fine way to talk to the 2% who were already going to buy and a perfect way to lose the 98% who were still deciding. That gap (between a visitor with a question and a rep who could answer it, three business days later, by email) is the thing Salesforce’s inbound Lead Generation agent is built to close.

It’s a new shape of product, and it’s also the single most-confused agent in the Agentforce catalog, because there are two sales agents with near-identical pitches and Salesforce renamed one of them mid-year. This post is about the inbound one: what it does on your website, how you stand it up, what it costs, and the security failure mode you take on the moment an agent starts reading text that strangers typed.

First, which agent this is, because there are two

Salesforce ships two Agentforce agents aimed at the top of the funnel, and they do almost opposite things:

Agentforce for Sales: Lead Generation: the inbound one, and the subject of this post. It engages net-new, anonymous visitors on your website, answers their questions, captures their details into a Lead, and books a meeting. It ships as a pre-configured Agentforce Service Agent (a template with a setup wizard, pre-built Topics, and Actions) set up from Agentforce for Sales → Inbound Lead Generation.
Agentforce Lead Nurturing, the outbound one. This is the agent that started life as the Einstein SDR Agent, and Salesforce renamed it to Lead Nurturing in the Winter ‘26 wave specifically to stop people confusing it with the Lead Generation template. It works over Leads that already exist in Salesforce (from events, imports, web-to-lead, manual entry) and nurtures them, mostly by email, over time.

The clean distinction: Lead Generation meets the stranger; Lead Nurturing works the list. They share plumbing and both can book meetings, but the inbound agent’s whole job is the anonymous visitor who isn’t in your CRM yet. If you want the outbound side, the agent that prospects and coaches, that’s a different pattern with a different failure mode, and the two should never be scoped as one project. Everything below is the inbound agent.

The Lead Generation agent became generally available in the Winter ‘26 release wave, whose GA began October 13, 2025.

What it does, in order

Strip the marketing and the agent runs a fairly concrete sequence. Because it’s a Service Agent under the hood, it rides the same deployment stack as any customer-facing agent and appears as a chat on a public page:

It greets an anonymous visitor. No login required, the messaging deployment surfaces a chat the visitor can start cold. An optional pre-chat form can collect a name and email up front, but the agent can also engage first and capture details in the flow of conversation.
It answers their questions from your content. This is the part that separates it from a decision-tree bot: product, pricing-structure, and company questions are answered through retrieval, grounded on sources you designate (Knowledge articles, uploaded files, and optionally web content) so it responds from your material rather than from the model’s imagination.
It qualifies and captures. Over the conversation it collects the fields you tell it to require (typically name, email, company, and some signal of intent) and creates a Lead record from them.
It offers real-time availability and books time. When the visitor is worth a conversation, the agent surfaces open slots and books a meeting directly into the right rep’s calendar.
It hands off with context. The interested lead, and the transcript and meeting, transitions to your sales team, so the rep who takes the call isn’t starting from “so, what brought you here today?”

A note on precision, because it matters for a build: I’m describing these steps functionally. Salesforce’s template ships specific internal Topics and Actions, but don’t hardcode assumptions about their exact labels into a design deck. Open the setup wizard and read the actual action list before you promise a stakeholder a particular built-in step. The shape above is stable; the internal names are what you verify.

How it’s deployed: Messaging for Web, and the pre-chat trap you already have

Because the Lead Generation agent is a Service Agent, it deploys through Messaging for In-App and Web (MIAW): the same Embedded Service snippet, Omni-Channel routing, and messaging deployment you’d use to put a service agent on your site. If you’ve done that build, you know most of this; if you haven’t, the mechanics (the snippet, the domains that 401 you, the routing) are the exact ground we covered in putting an Agentforce agent on your website.

That post also named the trap that’s worse here: the pre-chat form is unverified input. A service agent trusting a pre-chat “Contact ID” field can be talked into impersonation. On the Lead Generation agent, every visitor is anonymous by definition, so all the identity data is self-asserted: anyone can type any name, any email, any company. A pre-chat form filters casual spam and pranks; it does not verify that the person is who they say they are. Salesforce’s answer is an optional one-time-password (OTP) email verification step that confirms the visitor controls the email before the Lead is trusted. Treat pre-chat and in-conversation capture as claims until something verifies them, and turn OTP on if a spoofed lead would cost you anything downstream.

Grounding: the Data Library is what stops it inventing your pricing

An agent that answers product questions from open generation is a liability with a chat bubble. The Lead Generation agent grounds its answers through the Agentforce Data Library. Salesforce’s packaged, no-code front end for retrieval-augmented generation. You point it at a set of sources (Knowledge articles and their fields, uploaded files, and optionally web search), it indexes them, and the agent retrieves relevant passages at answer time instead of guessing.

Under the hood the Data Library sits on Data Cloud / Data 360 retrievers, but you don’t have to hand-build a retriever to use it, the wizard walks you through creating or selecting a library. If you want the deeper mechanics of how that indexing and retrieval behaves, we wrote it up in the Data Library, explained. The operational rule for a lead-gen agent is simple and strict: the answerable set is the grounded set. Anything the agent might state as fact about your product, pricing structure, or legal terms should come from a governed source in the library, and anything outside that boundary should route to a human rather than get improvised. A confidently wrong pricing answer on your own website is a worse outcome than no answer at all.

Lead creation, dedup, and the field-level gotchas

The capture step is where clean demos meet dirty orgs. Three things bite in production:

Field-level security decides whether the Lead saves at all. The agent creates the Lead as the agent user, so every field it must populate has to be writable by that user. The nastiest version: a required lookup field that isn’t visible to the agent user causes record creation to fail outright: the conversation goes fine, the visitor books a meeting, and no Lead exists. Audit the agent user’s profile against every required field on Lead before launch, not after the first lost lead.

Dependent picklists can’t be marked required for the agent to fill, so if your qualification depends on a controlling/dependent picklist pair, design around it rather than assuming the agent will force a value.

Deduplication is your existing Duplicate Management, not a magic agent feature. A new anonymous visitor is very often an existing Lead or Contact, the same person, new session. The agent leans on Salesforce’s standard matching and duplicate rules to avoid spawning a second record. If your Duplicate Management is weak today, the agent will faithfully manufacture duplicates at machine speed. Fix the matching rules first.

For meeting booking, be precise about what’s verified: the agent surfaces real-time calendar availability and books into the rep’s connected calendar (Microsoft 365 or Google) through the calendar/email integration. Whether a given setup routes through Salesforce Scheduler specifically depends on your configuration. Don’t assume it does. What you can rely on is that with activity capture in place, the meeting and email history land on the record, so the human takeover has the full thread.

What it costs: Flex Credits or Conversations, and why this agent leans one way

There’s no Lead-Generation-specific price. It consumes under your org’s general Agentforce billing, and in 2026 that’s one of two mutually exclusive models (figures as reported against Salesforce’s 2025 pricing update):

Flex Credits: roughly $500 per 100,000 credits, where a standard action costs 20 credits (about $0.10) and a voice action 30 credits (about $0.15). You draw down credits per action.
Conversations, about $2 per conversation, where a “conversation” is a 24-hour session with the agent. This model is designed for external, customer-facing agents.

The Lead Generation agent is exactly the external, customer-facing case the Conversations model targets, and the break-even is worth doing before you pick: Conversations tends to win once a session runs past roughly twenty actions, Flex Credits wins for short, low-action interactions. A lead-gen chat that answers three questions and books a meeting is short in conversation terms, so model both against your real traffic mix rather than defaulting. We walk the full break-even math and the levers in Flex Credits vs Conversations and the optimization playbook. The trap specific to public-website agents: your traffic is unauthenticated and unbounded, so a spike, or a bot storm, is a spike in billed interactions. Rate-limiting and abuse controls aren’t just hygiene here; they’re cost control.

The security failure mode: you just pointed an agent at strangers

Here’s the part that doesn’t make the keynote. The moment an agent reads text that anonymous people typed and then acts on it, you’ve created a prompt-injection surface, and this is not hypothetical for Agentforce lead handling.

In September 2025, researchers disclosed a vulnerability nicknamed ForcedLeak: an attacker embedded malicious instructions in a Web-to-Lead Description field, and an Agentforce agent processing that lead later executed the injected instructions, with data exfiltration made possible by an expired domain that was still on an allowlist. Salesforce remediated it, re-securing the domain and tightening trusted-URL enforcement, but the lesson generalizes cleanly to any inbound agent: untrusted input from a stranger is now inside your agent’s context, and your agent can take actions. The pre-chat field, the free-text message, the “company” the visitor typed, all of it is attacker-controllable.

The defenses are the ones we lay out in full in least-privilege for agents and prompt-injection, applied here specifically:

Scope the agent user hard. It should be able to create and read exactly the Leads it needs and nothing else. No broad object access, no destructive actions, no reason for it to reach data a lead-gen agent would never legitimately touch.
Keep answers grounded and actions deterministic. The agent decides whether to create a Lead or book a meeting; a governed Flow or Apex action decides how, the same way every time, with validation that untrusted field values can’t subvert.
Enforce guardrails at the reasoning layer, not just in instructions: the natural-language “you may not do X” plus the Einstein Trust Layer’s injection and toxicity screening, adversarially tested before launch.
Verify identity before you trust data. OTP for the email, and don’t wire self-asserted fields into anything sensitive downstream.

And the obligation the product doesn’t hand you: consent and PII. You’re capturing data from anonymous visitors, which puts you squarely in GDPR/CCPA territory. Salesforce gives you the plumbing; the consent capture, retention, and lawful-basis handling are the implementer’s job. Build it in; don’t discover it in an audit.

Clicks, code, and where the reliability lives

The template is deliberately clicks-first: a setup wizard, pre-built Topics (the scope of what the agent handles) each containing Actions (what it can execute). For most teams the standard actions plus grounding get you a working agent without a line of Apex.

Where you reach for code is where reliability has to be non-negotiable: a qualification rule that must run the same way every time, an integration to a marketing system, a routing decision that can’t be left to probabilistic reasoning. There, you extend with a custom action (a Flow or a prompt template), or drop to Agent Script for the parts that need deterministic control rather than prompt-tuning. The instinct is the same one that governs every serious agent build: let the model handle the open-ended conversation, and pin down the steps where “probably” isn’t good enough: record creation, meeting booking, and anything that spends money or touches PII.

The takeaway

The Lead Generation agent is one of the more immediately useful things in the Agentforce catalog because the job is narrow and the payoff is legible: fewer good visitors leaving unanswered, more qualified meetings on the calendar, and a rep’s first interaction starting from context instead of cold. But “pre-built” is not “hands-off.” The value comes from the grounding you configure, the fields and dedup rules you get right, the guardrails and identity checks you put between anonymous input and real actions, and the cost model you chose instead of defaulted into.

Get those right and you have a tireless first responder on your busiest anonymous page. Get them wrong and you have a confident stranger-facing bot that invents your pricing, manufactures duplicate leads, and reads instructions from people who don’t wish you well. The difference is entirely in the build.

Understanding the basics

What is the Agentforce Lead Generation agent?

It’s a pre-configured Agentforce Service Agent template that engages anonymous visitors on your website: it answers their questions using content you’ve grounded it on, qualifies them, creates a Lead record, and books a meeting on a rep’s calendar. It’s set up through a wizard under Agentforce for Sales and deploys via Messaging for Web (MIAW), so it appears as a chat on a public page. It became generally available in the Winter ‘26 wave (GA began October 13, 2025).

How is Lead Generation different from the Agentforce SDR / Lead Nurturing agent?

Lead Generation is inbound. It engages net-new, anonymous visitors on your site who aren’t in your CRM yet. Lead Nurturing (formerly the Einstein SDR Agent, renamed in Winter ‘26) is outbound. It works Leads that already exist in Salesforce and nurtures them over time, mostly by email. Salesforce renamed the SDR agent specifically to reduce the constant confusion between the two. In short: Lead Generation meets the stranger, Lead Nurturing works the list.

How does the Lead Generation agent avoid making up answers?

It grounds answers through the Agentforce Data Library, which uses retrieval-augmented generation over sources you designate (Knowledge articles, uploaded files, and optionally web content) so it answers from your material rather than open generation. The operating rule is that the answerable set is the grounded set: anything the agent might assert as fact should come from a governed source, and out-of-scope questions should route to a human rather than be improvised.

What does the Lead Generation agent cost?

There’s no separate price for it; it consumes under your org’s general Agentforce billing, which in 2026 is either Flex Credits (about $500 per 100,000 credits; roughly $0.10 per standard action) or Conversations (about $2 per 24-hour conversation, aimed at external customer-facing agents), and the two are mutually exclusive per org. A public-website agent is exactly the external case the Conversations model targets, but because lead-gen chats are short, it’s worth running the break-even against your real traffic before choosing, and adding abuse controls, since unauthenticated traffic is billable traffic.

Is it safe to point an agent at anonymous website visitors?

Only if you build for it. Anonymous input is attacker-controllable, and the 2025 “ForcedLeak” disclosure showed prompt injection reaching an Agentforce lead-handling agent through a Web-to-Lead field. Scope the agent user to least privilege, keep actions deterministic and guardrailed, enforce guardrails at the reasoning layer with the Einstein Trust Layer, verify identity with OTP before trusting captured data, and handle consent and PII yourself, the product provides the plumbing, not the compliance.

Standing up an inbound agent on a public page is equal parts conversation design, data hygiene, and security engineering, and the last one is the part that turns a demo into a liability if it’s skipped. Talk to us. We build lead-gen agents that qualify the stranger without trusting them.