Salesforce Agentforce Vulnerability Exposes Internal Agent Instructions to External Users

Agentforce and Email-to-Case Interaction

Salesforce's Agentforce allows agents to respond to events via Flows, triggered by record creation or updates. Standard features like Email-to-Case and Web-to-Case convert inbound customer messages into case records. When these features are chained, an external email can create a case record, which then passes data into an agent's prompt, allowing the agent to act and reply.

This chain creates a path where an unauthenticated external user can send an email, which then influences an internal agent's instructions and receives an outbound reply. The system operates as designed, indicating a fundamental security oversight in how agents integrate with existing platform functionalities.

Application-Level Risk, Not Model Misconfiguration

The core of the vulnerability lies in the application layer surrounding the agent, not in the agent's underlying model. Variables such as enabled intake features, trigger configurations, guest user object exposure, and automation passing untrusted data determine the severity of the risk. These factors are often overlooked in security reviews, especially if the agent was not part of the initial procurement assessment.

Prompt filters, designed to monitor agent inputs, are ineffective in this scenario because they do not understand the origin of data from features like Email-to-Case. This means the filter cannot differentiate between trusted internal input and untrusted external input.

Challenges in Securing Inherited Agents

Securing an inherited agent requires a deep understanding of its host application's configuration, a level of detail often missing from standard questionnaires and scanners. The City-Forum campaign, an ongoing data-theft operation targeting Salesforce and ServiceNow instances since March 2025, exploits similar gaps between platform features and enterprise configurations.

The ease of creating agents within platforms means various departments can build them, each operating with the creator's permissions. This creates 'shadow agents' that can run unattended with the access levels of their creators, multiplying potential exposure risks.