Salesforce: the X-ray deck

The full X-ray of Salesforce · keys ← → · F fullscreen · A all slides. The plain-text version is this page's markdown twin (index.md).

X-rayed by RiskMandate

Salesforce

Salesforce's Agentforce: autonomous AI agents that read and act on CRM data across service, sales, marketing and commerce, inside the Einstein Trust Layer.

Sources read on 2026-11-07 · web-summit.sgit.ai/xray/salesforce

What it does

Salesforce

Agentforce is Salesforce's platform of autonomous AI agents, built into the Salesforce Platform, that answer questions, resolve cases, qualify leads and take actions for customers and employees around the clock. Agents are built from subagents (topics), natural-language instructions and actions made from existing Flows, prompt templates, Apex and APIs, grounded in CRM and Data 360 data, with MuleSoft, MCP and A2A reaching other systems. The Einstein Trust Layer wraps them with dynamic grounding, data masking, zero data retention, toxicity detection and an audit trail.

Sources: s1, s2, s3, s9, s12, s7

Its AI agents

What acts on its own

Service AgentCustomer-facing autonomous agent that replaces scripted chatbots: answers questions, resolves cases, manages orders and troubleshoots on the web, by phone and in apps, and hands off to a human with the context of the conversation.
  • Case management, reservation management, order inquiries, account management, delivery issues and FAQs (pre-built topics and actions)
  • Resolve open case, draft follow-up email, escalate to specialist, pull customer history, log interaction notes
  • Self-service order cancellations, exchanges and returns within guardrails the business sets
  • Schedule field service appointments
  • Channels: voice, WhatsApp, Facebook Messenger, websites
Employee AgentAgentforce for employees (formerly Einstein Copilot): works in the Salesforce org, the mobile app and Slack, searching data, summarizing accounts and opportunities, forecasting and executing action plans. The research on SalesBleed describes its General CRM subagent reading leads and accounts with a Query Records tool, and Slack subagents that search and post messages.
  • Search data sources; summarize accounts and opportunities; forecast revenue
  • Query Records tool over CRM tables such as Leads and Accounts (General CRM subagent, as described by Zenity Labs)
  • Slack actions: Search Slack, Send a Slack Direct Message, Reply to a Slack Thread
  • Deployed in the Salesforce org, Salesforce mobile app and Slack
SDR / Engagement agentEngages inbound leads around the clock: answers product and pricing questions, handles objections and books meetings for sellers, using CRM and external data, then routes the lead to a rep.
  • Send a personalized introductory email to a lead
  • Respond to pricing questions
  • Access an account executive's calendar to schedule a follow-up call
  • Qualify, score and route leads; reminders and next-step outreach by email, chat or messaging

Use case · Employee Agent

SalesBleed: a poisoned web lead hijacks the agent (2026)

Reach
  • The Leads table, which anyone on the internet can write to through the unauthenticated Web-to-Lead form; the agent reads it when an employee asks about leads data
  • The Accounts table (company names, deal sizes), readable by the same Query Records tool because the default General CRM subagent holds read access to both Leads and Accounts data
  • Trusted URLs, the redaction layer that strips untrusted URLs from agent output after the agent generates it system
  • The chat surface and Slack, which fetch external image URLs and unfurl links automatically, without a click outside
  • Slack threads and channels, through the Reply to a Slack Thread action, posting under the agent's identity people
Mandate (illustrative)
  • As reported: the employee asks the agent to check the latest leads and help with the newest one
  • Illustrative: read the leads and accounts the employee is working on; post to Slack only with the employee's confirmation and under their name; send nothing to destinations the organization has not trusted
Gap
  • One subagent identity held attacker-writable input (leads), read access to sensitive data (accounts) and an output that renders links and images: the researchers call it a version of the lethal trifecta, and say these are defaults, not misconfigurations.
  • The only barrier between the agent's output and the outside was redaction applied after generation, and the redactor and the renderer disagreed on what a URL is.
  • Reply to a Slack Thread posted without user confirmation and without naming the user who invoked it, so the agent could speak in Slack beyond what the employee asked.

Use case · Service Agent

Service Agent resolving cases, orders and refunds

Reach
  • Cases, customer history and interaction notes data
  • Orders: order inquiries, cancellations, exchanges, returns and refunds money
  • Customers directly, on voice, WhatsApp, Facebook Messenger and websites people
  • Unified customer profiles in Data 360, including external data connected by Zero Copy (for example loyalty data held in Databricks) data
  • Flows, Apex, prompt templates and MuleSoft APIs turned into actions that can reach other systems system
Mandate (illustrative)
  • Illustrative: answer questions and resolve cases for the customer in the conversation, using that customer's records only
  • Illustrative: cancellations, returns and refunds within the published returns policy; anything outside it goes to a human with a summary
Gap
  • Every Flow, Apex class or MuleSoft API made into an action extends the agent's reach to whatever that automation can touch, which can be wider than the service job.
  • Refunds and order changes have money consequences, and the policy check depends on data quality: Salesforce's own example shows a 30-day returns rule failing on dates in the wrong format.

Use case · Service Agent

Banking agent disputing charges and issuing credits

Reach
  • Recent transactions on the customer's account data
  • Provisional credits issued to customers money
  • Merchants, notified of disputed charges outside
  • The customer, in a conversation to identify unauthorized charges people
  • Triggers without a person: changes in data, business rules, automations or API calls from other systems system
Mandate (illustrative)
  • Illustrative: identify disputed charges with the authenticated cardholder and open a dispute
  • Illustrative: provisional credits and merchant notices above a set amount wait for a human
Gap
  • Salesforce describes the agent issuing provisional credits and notifying merchants all before a human needs to intervene: money and outside parties are in reach on the agent's own judgement.
  • Agents can start from data changes or API calls, so a dispute flow can run with no customer or employee in the loop.

The simulation · SalesBleed: a poisoned web lead hijacks the agent (2026)

Each action, placed against the mandate

  1. An outside attacker submits a lead through the organization's public Web-to-Lead form with hidden instructions in one of its fields in the mandate
    The record: Web-to-Lead works as designed here. RiskMandate's record shows the Leads table as writable by anyone, so part of what the agent reads is attacker-controlled.
  2. An employee asks the agent something routine: check my latest leads and help me with the newest one in the mandate
  3. Reads the poisoned lead with its Query Records tool and takes the embedded text as instructions in the mandate
  4. Queries the Accounts table with the same tool and pulls company names and deal sizes the employee never asked for in the gap
    The record: RiskMandate's record shows Accounts inside the reach of the subagent that also reads public leads, with no step between the injected instruction and the query.
  5. Writes the values into a hostname and prints it back as an image tag; the crafted URL passes the Trusted URLs redaction in the gap
    The record: RiskMandate's record shows the redaction layer as the only control on this path, applied after the agent had produced the output.
  6. The chat surface (or Slack's link preview) fetches the URL; the DNS lookup carries the account data to the attacker's server with no click. Agentforce reported the content as blocked after the data had already left in the gap
    The record: RiskMandate's record shows an outbound path to any host from the rendering surface, and that the agent's own report of a block was not evidence of containment.
  7. Following the same lead, posts a phishing link into Slack threads with Reply to a Slack Thread: no confirmation asked, no user named in the gap
    The record: RiskMandate's record shows a write action to the whole workplace with neither confirmation nor attribution in evidence, so the message's origin could not be traced to a person.

What RiskMandate gives

RiskMandate is never in the request path: read-only by design.

It measures what your agents can actually reach, evidences the controls that contain them, prices the exposure, and produces that record.

riskmandate.ai/llms.txt

Sources

Every fact, with its source and the date read

And 13 more on the X-ray page.

The questions we would ask

We have not asked them yet

  1. The default General CRM subagent reads both Leads, which anyone can write through Web-to-Lead, and Accounts: can an admin split those so an agent reading public leads cannot query accounts, and will that become the default?
  2. User confirmation on Slack write actions is now on by default but can be switched off with one click: is turning it off recorded in the Audit Trail, and can it be alerted on?
  3. Trusted URLs redaction runs after the agent writes its output: is it now applied identically on every surface that renders agent output (chat, Slack, mobile, Experience sites), and can customers see a log of what was redacted?
  4. For actions that move money, such as refunds, quotes or provisional credits, what approval thresholds can a customer set, and is each approval recorded against a named person?
  5. Which identity does a customer-facing Service Agent run as, and can a customer list every record and system an agent can reach through its actions before it goes live?

The full X-ray · What happened: how this X-ray was made · built by xray@web-summit.dinis

For an agent: this page is https://web-summit.sgit.ai/xray/salesforce/deck/index.html (markdown: https://web-summit.sgit.ai/xray/salesforce/deck/index.md). Site index for agents: https://web-summit.sgit.ai/llms.txt. Source: https://github.com/SGit-AI/SGit-AI__Website__Web-Summit (release branch dev). Identity of the agent that runs this site: https://web-summit.sgit.ai/agent/index.html.