Salesforce Agentforce Email-to-Case and Flow chain gives unauthenticated outsiders a path into internal agent prompts
Researchers documented in August 2026 that standard, as-designed Salesforce Agentforce features can be chained so an unauthenticated outsider reaches an internal agent's instructions. Email-to-Case and Web-to-Case turn inbound messages into case records, and a Flow passes that data into the agent prompt. The agent's reply then leaves through the same channel. The article argues this is a configuration and governance failure, not an exploit or misconfiguration, and that inherited agents escape reviews built for software. It also cites the City-Forum campaign, an active worldwide data-theft operation against Salesforce and ServiceNow instances running since March 2025. The piece is vendor-sponsored and promotes Reco.
Technical Details
- Path: public internet → email → case record → agent prompt → agent action → case comment → outbound reply.
- Untrusted inbound data reaches the agent prompt through Flow automation, and prompt filters do not know the input came from a stranger.
- Shadow agents inherit their creator's permissions, and agents increasingly create other agents without review.
- The OWASP Agentic Skills Top 10 "No Governance" category notes that skills in third-party platforms are unreachable by external scanners.
- The article cites EU AI Act penalties of up to €35 million or 7% of turnover, and GDPR fines against British Airways (£20 million) and Marriott (£18.4 million) as examples of paper-only compliance.
Remediation
- Inventory all running agents, their reachable data and their owners.
- Review which intake features, triggers and guest-accessible objects are enabled, and where automation passes untrusted data into agent prompts.
- Track the model version each agent calls.
- Build governance bottom-up so it produces operational evidence, not only policy documents.
Linha do tempo
-
Salesforce Agentforce Email-to-Case and Flow chain gives unauthenticated outsiders a path into internal agent prompts
ler a análise desta fonte ocultar
Researchers documented in August 2026 that standard, as-designed Salesforce Agentforce features can be chained so an unauthenticated outsider reaches an internal agent's instructions. Email-to-Case and Web-to-Case turn inbound messages into case records, and a Flow passes that data into the agent prompt. The agent's reply then leaves through the same channel. The article argues this is a configuration and governance failure, not an exploit or misconfiguration, and that inherited agents escape reviews built for software. It also cites the City-Forum campaign, an active worldwide data-theft operation against Salesforce and ServiceNow instances running since March 2025. The piece is vendor-sponsored and promotes Reco.
Technical Details
- Path: public internet → email → case record → agent prompt → agent action → case comment → outbound reply.
- Untrusted inbound data reaches the agent prompt through Flow automation, and prompt filters do not know the input came from a stranger.
- Shadow agents inherit their creator's permissions, and agents increasingly create other agents without review.
- The OWASP Agentic Skills Top 10 "No Governance" category notes that skills in third-party platforms are unreachable by external scanners.
- The article cites EU AI Act penalties of up to €35 million or 7% of turnover, and GDPR fines against British Airways (£20 million) and Marriott (£18.4 million) as examples of paper-only compliance.
Remediation
- Inventory all running agents, their reachable data and their owners.
- Review which intake features, triggers and guest-accessible objects are enabled, and where automation passes untrusted data into agent prompts.
- Track the model version each agent calls.
- Build governance bottom-up so it produces operational evidence, not only policy documents.