Skip to content
Salesforce Agentforce Vulnerability Exposes Internal Agent Instructions

Salesforce Agentforce Vulnerability Exposes Internal Agent Instructions

First seen 20 Oct 2026, 03:21 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 04:50 UTC
  • •Unauthenticated messages can trigger internal agent actions in Salesforce Agentforce.
  • •The vulnerability stems from host application configurations, not AI model flaws.
  • •The City-Forum campaign has been exploiting this issue since March 2025.

Researchers identified a vulnerability in Salesforce Agentforce where unauthenticated outsiders can send messages that become agent prompts through Email-to-Case and Web-to-Case features. This chain allows external input to reach internal agent instructions without misconfiguration. The risk arises from how the host application's features and permissions are configured, rather than the AI model itself. The issue was documented in August 2026, highlighting the gap between platform capabilities and actual configurations used by enterprises. The City-Forum campaign, a data-theft operation targeting Salesforce and ServiceNow instances, has exploited this vulnerability since March 2025. Organizations using these features are at risk of data exposure if proper governance and security measures are not in place.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-01
Vulnerability documented
Researchers reported the ability for unauthenticated outsiders to send messages that trigger agent actions in Salesforce Agentforce.
Feeds.Feedburner
2026-10-19
Articles published
Two articles were published detailing the vulnerability and its implications for Salesforce Agentforce.
Feeds.Feedburner
2026-10-19
City-Forum campaign identified
The City-Forum campaign was confirmed to be exploiting this vulnerability in Salesforce and ServiceNow instances.
Feeds.4Sysops

More articles in this cluster (3)

Following this threat?

Track Salesforce in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

How can I determine if I'm affected?
Check if your Salesforce Agentforce instance uses Email-to-Case or Web-to-Case features connected to agent-triggering Flows.
What are the risks associated with this vulnerability?
The main risk is that unauthenticated external messages can manipulate internal agent actions, potentially leading to data exposure.
What should organizations do to mitigate this risk?
Organizations should review their Salesforce configurations, restrict permissions, and implement stricter governance over agent actions.