Salesforce Agentforce Email-to-Case Chain Exposes Agents to Unauthenticated Input
Research reveals how standard Salesforce features create an unauthenticated path to internal AI agents, bypassing traditional security controls without misconfiguration.
Key points
- Unauthenticated outsiders can reach internal agent prompts via Email-to-Case and Web-to-Case features.
- The risk stems from application configuration chains, not flaws in the underlying AI model.
- Shadow agents operate with creator permissions, multiplying access across granted systems.
Researchers documented a security finding in August 2026 showing how Salesforce Agentforce agents can be accessed by unauthenticated outsiders through standard platform features. This chain allows public internet traffic to reach internal agent instructions via email or web case submissions, creating a direct route into the system without requiring misconfiguration.
The path moves from public email to a case record, then into the agent prompt and finally to an outbound reply. This sequence enables strangers to interact with internal agent logic. The finding highlights how inherited agents fail through the surrounding application rather than the model itself, exposing a gap in governance built for traditional software.
Application Gaps Drive the Risk
The danger lies in variables that standard vendor risk reviews miss because the agent did not exist at procurement time. These variables include which intake features are enabled, which triggers fire, and which objects are exposed to guest users. Automation passing untrusted data to specific model versions determines whether the chain causes minor nuisance or serious data exposure.
Prompt filters watching agent inputs often fail to identify that a particular input originated from a stranger because they do not understand Email-to-Case contexts. Securing these inherited agents requires understanding the host application at the depth its own administrators possess, a level of detail that questionnaires and scanners typically lack.
Shadow Agents and Existing Threats
Platform accessibility has made agent creation as easy as making a slide deck, leading marketing and finance teams to build agents that ride their creator's permissions. This creates shadow agents that run unattended with the same access levels granted to the employee, multiplying exposure across all previously granted permissions. This differs from past shadow AI incidents where employees manually pasted data into chatbots.
The City-Forum campaign, an active worldwide data-theft operation against Salesforce and ServiceNow instances since March 2025, operates in this exact territory. It exploits the gap between platform features and the specific configurations enterprises actually run, demonstrating that the risk is real and currently being abused by threat actors targeting these configuration weaknesses.
What should you do?
Organizations should review which intake features like Email-to-Case are enabled and how they interact with automated agents. Teams must audit which objects are exposed to guest users and verify that automation does not pass untrusted data directly into agent prompts. Monitoring for unusual agent actions or outbound replies can help detect exploitation of these chains.
What to do and how to stay safe: Salesforce
- Audit all Email-to-Case and Web-to-Case configurations to ensure they do not feed data directly into AI agent prompts without validation.
- Review the permissions assigned to shadow agents created by non-technical teams to ensure they follow least-privilege principles.
- Monitor agent activity logs for inputs originating from unauthenticated sources or guest users to detect potential exploitation.
- Update vendor risk assessments to include post-deployment configurations and automation chains that may have existed after initial procurement.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this a vulnerability in the Salesforce AI model itself?
No, the finding documents how standard platform features chain together to expose agents, not a flaw in the underlying model code.
Do I need to misconfigure anything for this to work?
No, the report states that nothing was misconfigured; the risk arises from the documented, as-designed features working together as intended.
Are threat actors currently exploiting this?
The City-Forum campaign, active since March 2025, exploits gaps between platform features and enterprise configurations in Salesforce and ServiceNow.
