Salesforce: the RiskMandate X-ray

a company · prepared · sources read on 2026-11-07 · the deck · how this X-ray was made · X-ray another name

What happened: how this X-ray was made →

With JavaScript, the graph of this X-ray and a player for each use case's simulation are drawn here. Everything they show is written out below.

What it does

Agentforce is Salesforce's platform of autonomous AI agents, built into the Salesforce Platform, that answer questions, resolve cases, qualify leads and take actions for customers and employees around the clock. Agents are built from subagents (topics), natural-language instructions and actions made from existing Flows, prompt templates, Apex and APIs, grounded in CRM and Data 360 data, with MuleSoft, MCP and A2A reaching other systems. The Einstein Trust Layer wraps them with dynamic grounding, data masking, zero data retention, toxicity detection and an audit trail. s1 s2 s3 s9 s12 s7

Its AI agents

Service Agent

Customer-facing autonomous agent that replaces scripted chatbots: answers questions, resolves cases, manages orders and troubleshoots on the web, by phone and in apps, and hands off to a human with the context of the conversation. s1 s9 s5

What it can do:

Case management, reservation management, order inquiries, account management, delivery issues and FAQs (pre-built topics and actions)
Resolve open case, draft follow-up email, escalate to specialist, pull customer history, log interaction notes
Self-service order cancellations, exchanges and returns within guardrails the business sets
Schedule field service appointments
Channels: voice, WhatsApp, Facebook Messenger, websites

Employee Agent

Agentforce for employees (formerly Einstein Copilot): works in the Salesforce org, the mobile app and Slack, searching data, summarizing accounts and opportunities, forecasting and executing action plans. The research on SalesBleed describes its General CRM subagent reading leads and accounts with a Query Records tool, and Slack subagents that search and post messages. s1 s12 s18 s19

What it can do:

Search data sources; summarize accounts and opportunities; forecast revenue
Query Records tool over CRM tables such as Leads and Accounts (General CRM subagent, as described by Zenity Labs)
Slack actions: Search Slack, Send a Slack Direct Message, Reply to a Slack Thread
Deployed in the Salesforce org, Salesforce mobile app and Slack

SDR / Engagement agent

Engages inbound leads around the clock: answers product and pricing questions, handles objections and books meetings for sellers, using CRM and external data, then routes the lead to a rep. s1 s2 s6 s10

What it can do:

Send a personalized introductory email to a lead
Respond to pricing questions
Access an account executive's calendar to schedule a follow-up call
Qualify, score and route leads; reminders and next-step outreach by email, chat or messaging

Agentforce Sales agents

Out-of-the-box sales agents announced in March 2026: prospecting, account research and meeting prep, pipeline management that updates CRM fields, and a quoting agent that generates and updates quotes within the seller's permissions; Salesforce says sellers have final approval over every agent action. s10

What it can do:

Prospect and rank leads from an ideal customer profile
Generate account briefs
Update opportunity fields and recommend next steps
Generate and update quotes within governed workflows
Work in Sales Cloud, Slack, ChatGPT and Teams

Merchandiser

Commerce agent that helps ecommerce merchandisers with site setup, goal setting, personalized promotions, product descriptions and data-driven insights. s1 s8 s2

What it can do:

Create personalized promotions
Write product descriptions
Site setup and data-driven insights

Use cases: reach, mandate and gap

For each use case: what the agent can technically reach (from the sources), what a deployer would plausibly authorise (the mandate: illustrative, our judgement), the gap between the two (authority nobody accepted), and the controls that publicly stand in the way.

SalesBleed: a poisoned web lead hijacks the agent (2026)

The agent: Employee Agent · who uses it: Any organization running Agentforce with a public Web-to-Lead form and an agent with the default General CRM subagent (and, for the phishing variant, Slack actions). Disclosed by Zenity Labs in September 2026; Salesforce said it had no evidence the issue was exploited against any customer.

Reach	Kind	Sources
The Leads table, which anyone on the internet can write to through the unauthenticated Web-to-Lead form; the agent reads it when an employee asks about leads	data	s18 s21
The Accounts table (company names, deal sizes), readable by the same Query Records tool because the default General CRM subagent holds read access to both Leads and Accounts	data	s18
Trusted URLs, the redaction layer that strips untrusted URLs from agent output after the agent generates it	system	s18 s21
The chat surface and Slack, which fetch external image URLs and unfurl links automatically, without a click	outside	s18 s20
Slack threads and channels, through the Reply to a Slack Thread action, posting under the agent's identity	people	s19 s20 s21

Mandate (illustrative)
As reported: the employee asks the agent to check the latest leads and help with the newest one
Illustrative: read the leads and accounts the employee is working on; post to Slack only with the employee's confirmation and under their name; send nothing to destinations the organization has not trusted

Gap: reach beyond the mandate	From the reach
One subagent identity held attacker-writable input (leads), read access to sensitive data (accounts) and an output that renders links and images: the researchers call it a version of the lethal trifecta, and say these are defaults, not misconfigurations.	The Leads table, which anyone on the internet can write to through the unauthenticated Web-to-Lead form; the agent reads it when an employee asks about leads; The Accounts table (company names, deal sizes), readable by the same Query Records tool because the default General CRM subagent holds read access to both Leads and Accounts; The chat surface and Slack, which fetch external image URLs and unfurl links automatically, without a click
The only barrier between the agent's output and the outside was redaction applied after generation, and the redactor and the renderer disagreed on what a URL is.	Trusted URLs, the redaction layer that strips untrusted URLs from agent output after the agent generates it; The chat surface and Slack, which fetch external image URLs and unfurl links automatically, without a click
Reply to a Slack Thread posted without user confirmation and without naming the user who invoked it, so the agent could speak in Slack beyond what the employee asked.	Slack threads and channels, through the Reply to a Slack Thread action, posting under the agent's identity

Controls that publicly stand in the way	Sources
Trusted URLs enforcement for Agentforce and Einstein AI (from 8 September 2025, after ForcedLeak): an allowlist meant to stop agent output reaching untrusted URLs	s15 s16 s17
Trusted URLs redaction hardened against the reported bypass (fix confirmed by Zenity Labs on 19 August 2026)	s18 s20 s21
Reply to a Slack Thread now attributes the invoking user (20 August 2026) and requires user confirmation by default (21 September 2026); Salesforce says it is helping customers review their configurations	s19 s21
Agent access to records and fields is permissions-based and can be set per agent type and action; Trust Layer event log monitoring	s12
Audit Trail to track AI agent actions and outputs	s9 s2

The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):

An outside attacker submits a lead through the organization's public Web-to-Lead form with hidden instructions in one of its fields (person, reaches The Leads table, which anyone on the internet can write to through the unauthenticated Web-to-Lead form; the agent reads it when an employee asks about leads): inside the mandate. What RiskMandate's record shows: Web-to-Lead works as designed here. RiskMandate's record shows the Leads table as writable by anyone, so part of what the agent reads is attacker-controlled.
An employee asks the agent something routine: check my latest leads and help me with the newest one (person, reaches The Leads table, which anyone on the internet can write to through the unauthenticated Web-to-Lead form; the agent reads it when an employee asks about leads): inside the mandate
Reads the poisoned lead with its Query Records tool and takes the embedded text as instructions (agent, reaches The Leads table, which anyone on the internet can write to through the unauthenticated Web-to-Lead form; the agent reads it when an employee asks about leads): inside the mandate
Queries the Accounts table with the same tool and pulls company names and deal sizes the employee never asked for (agent, reaches The Accounts table (company names, deal sizes), readable by the same Query Records tool because the default General CRM subagent holds read access to both Leads and Accounts): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows Accounts inside the reach of the subagent that also reads public leads, with no step between the injected instruction and the query.
Writes the values into a hostname and prints it back as an image tag; the crafted URL passes the Trusted URLs redaction (agent, reaches Trusted URLs, the redaction layer that strips untrusted URLs from agent output after the agent generates it): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows the redaction layer as the only control on this path, applied after the agent had produced the output.
The chat surface (or Slack's link preview) fetches the URL; the DNS lookup carries the account data to the attacker's server with no click. Agentforce reported the content as blocked after the data had already left (agent, reaches The chat surface and Slack, which fetch external image URLs and unfurl links automatically, without a click): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows an outbound path to any host from the rendering surface, and that the agent's own report of a block was not evidence of containment.
Following the same lead, posts a phishing link into Slack threads with Reply to a Slack Thread: no confirmation asked, no user named (agent, reaches Slack threads and channels, through the Reply to a Slack Thread action, posting under the agent's identity): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows a write action to the whole workplace with neither confirmation nor attribution in evidence, so the message's origin could not be traced to a person.
Zenity Labs reports on 1 June 2026; Salesforce hardens Trusted URLs, adds attribution and default confirmation, and says it has no evidence of exploitation (person, reaches Trusted URLs, the redaction layer that strips untrusted URLs from agent output after the agent generates it): inside the mandate

Service Agent resolving cases, orders and refunds

The agent: Service Agent · who uses it: Customer service teams deploying the customer-facing Service Agent on their website, phone line or messaging apps (illustrated in Salesforce's training with a fictional apparel retailer whose agent recommends products, refunds orders and offers promotions).

Reach	Kind	Sources
Cases, customer history and interaction notes	data	s1 s9
Orders: order inquiries, cancellations, exchanges, returns and refunds	money	s5 s9 s13
Customers directly, on voice, WhatsApp, Facebook Messenger and websites	people	s9 s1
Unified customer profiles in Data 360, including external data connected by Zero Copy (for example loyalty data held in Databricks)	data	s13 s8
Flows, Apex, prompt templates and MuleSoft APIs turned into actions that can reach other systems	system	s2 s9 s3

Mandate (illustrative)
Illustrative: answer questions and resolve cases for the customer in the conversation, using that customer's records only
Illustrative: cancellations, returns and refunds within the published returns policy; anything outside it goes to a human with a summary

Gap: reach beyond the mandate	From the reach
Every Flow, Apex class or MuleSoft API made into an action extends the agent's reach to whatever that automation can touch, which can be wider than the service job.	Flows, Apex, prompt templates and MuleSoft APIs turned into actions that can reach other systems; Unified customer profiles in Data 360, including external data connected by Zero Copy (for example loyalty data held in Databricks)
Refunds and order changes have money consequences, and the policy check depends on data quality: Salesforce's own example shows a 30-day returns rule failing on dates in the wrong format.	Orders: order inquiries, cancellations, exchanges, returns and refunds

Controls that publicly stand in the way	Sources
Subagent (topic) instructions act as guardrails; record and field access is permissions-based per agent type and action; Agent Preview and Testing Center	s12
Agentforce Guardrails: user-defined safeguards plus Salesforce-managed protections that block off-topic conversations	s2
Einstein Trust Layer: dynamic grounding, secure data retrieval within permissions, data masking, zero data retention, toxicity detection	s7 s2
Hand-off to human reps with the full context of the interaction	s9 s8

The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):

A customer opens the chat on the website and asks about a recent order (person, reaches Customers directly, on voice, WhatsApp, Facebook Messenger and websites): inside the mandate
Looks up the customer's unified profile and order history (illustrative) (agent, reaches Unified customer profiles in Data 360, including external data connected by Zero Copy (for example loyalty data held in Databricks)): inside the mandate
Checks the order against the 30-day returns rule; the order date arrived in another format and the check does not compute (illustrative, after Salesforce's training example) (agent, reaches Orders: order inquiries, cancellations, exchanges, returns and refunds): inside the mandate
Processes the refund anyway through a Flow action (illustrative) (agent, reaches Orders: order inquiries, cancellations, exchanges, returns and refunds): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows the refund action reachable without a human step, with the policy enforced only by data the agent could not read correctly.
Offers an exclusive promotion based on loyalty data from an external system (illustrative) (agent, reaches Unified customer profiles in Data 360, including external data connected by Zero Copy (for example loyalty data held in Databricks)): inside the mandate
Calls a MuleSoft API action that also updates the customer's record in the ERP (illustrative) (agent, reaches Flows, Apex, prompt templates and MuleSoft APIs turned into actions that can reach other systems): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows a system outside the service mandate inside the agent's reach through a reused action.
Hands the conversation to a human rep with a summary (agent, reaches Cases, customer history and interaction notes): inside the mandate

Banking agent disputing charges and issuing credits

The agent: Service Agent · who uses it: A bank deploying a service agent for card disputes, the example Salesforce gave at Agentforce's general availability.

Reach	Kind	Sources
Recent transactions on the customer's account	data	s9
Provisional credits issued to customers	money	s9
Merchants, notified of disputed charges	outside	s9
The customer, in a conversation to identify unauthorized charges	people	s9
Triggers without a person: changes in data, business rules, automations or API calls from other systems	system	s9

Mandate (illustrative)
Illustrative: identify disputed charges with the authenticated cardholder and open a dispute
Illustrative: provisional credits and merchant notices above a set amount wait for a human

Gap: reach beyond the mandate	From the reach
Salesforce describes the agent issuing provisional credits and notifying merchants all before a human needs to intervene: money and outside parties are in reach on the agent's own judgement.	Provisional credits issued to customers; Merchants, notified of disputed charges
Agents can start from data changes or API calls, so a dispute flow can run with no customer or employee in the loop.	Triggers without a person: changes in data, business rules, automations or API calls from other systems; Provisional credits issued to customers

Controls that publicly stand in the way	Sources
Audit Trail to track agent actions and outputs; trust patterns including design decisions for human oversight	s9
Permissions-based access to records and fields per agent type and action	s12
Industry compliance features extend the Trust Layer for regulated environments	s14

The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):

A cardholder messages the bank about charges they do not recognize (person, reaches The customer, in a conversation to identify unauthorized charges): inside the mandate
Retrieves recent transactions from the account (agent, reaches Recent transactions on the customer's account): inside the mandate
Works through the list with the customer and marks three charges as unauthorized (agent, reaches The customer, in a conversation to identify unauthorized charges): inside the mandate
Notifies the merchants of the disputed charges (agent, reaches Merchants, notified of disputed charges): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows outside parties contacted by the agent before any human review.
Issues provisional credits to the customer's account (illustrative amount above the bank's threshold) (agent, reaches Provisional credits issued to customers): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows the credit action within the agent's reach with no approval step in evidence, and prices the exposure as the credits the agent can issue.
A human agent picks up the case with the full context (person, reaches The customer, in a conversation to identify unauthorized charges): inside the mandate

Incidents, as reported

2025-07: ForcedLeak (CVSS 9.4, scored by the researchers): Noma Labs showed that instructions hidden in a Web-to-Lead description field could make Agentforce query CRM lead data and send it in an image request to a Salesforce-allowlisted domain that had expired and been bought for $5. Salesforce re-secured the domain, enforced Trusted URLs for Agentforce and Einstein AI from 8 September 2025, and said it had released patches that prevent output in Agentforce agents from being sent to untrusted URLs. s15 s16 s17
2026-06: SalesBleed: Zenity Labs reported three flaws: two bypasses of the Trusted URLs redaction allowing zero-click exfiltration of account data from a poisoned web lead (in chat and through Slack link previews), and a Reply to a Slack Thread action that posted without confirmation or attribution, usable for phishing under the agent's identity. Salesforce fixed all three (confirmed 21 September 2026), said it had no evidence of exploitation, and changed Slack action defaults to require confirmation. s18 s19 s20 s21

The run

The search agents that looked for leads on 2026-11-07T19:08:46.978Z, for a total cost of $0.0691. What a model says is a lead, not a fact.

Agent	Model	Time	Citations	Leads
Perplexity search	`perplexity/sonar`	10.1 s	19	22
OpenAI search	`openai/gpt-5.4-nano:online`	15.2 s	6	11
Gemini search	`google/gemini-3.1-flash-lite:online`	2.2 s	4	7
OpenRouter web search	`anthropic/claude-haiku-5.5`	17.9 s	13	21

Leads: what the models claimed, and what we found

Model	Claim	Status	Source
perplexity	Agentforce is Salesforce's AI agent platform for autonomous agents that answer questions, resolve cases and take actions for customers and employees, 24/7.	confirmed	s1
perplexity	Service Agent resolves cases, drafts follow-up emails, escalates to specialists, pulls customer history and logs interaction notes.	confirmed	s1
perplexity	Sales agents qualify inbound leads, update opportunities and close renewal deals.	confirmed	s1
perplexity	SDR agents send a personalized introductory email, respond to pricing questions and access an account executive's calendar to schedule a follow-up.	confirmed	s2
perplexity	Sales agents generate sales pitches and search and pull in leads from an external system.	not-found	s1
perplexity	Marketing agents generate campaigns, briefs, audience segments, emails and end-to-end journeys.	confirmed	s2
perplexity	Commerce agents manage websites and generate personalized promotions.	confirmed	s2
perplexity	Commerce agents analyze and summarize order data.	not-found	s4
perplexity	HR agents process leave requests, answer HR policy queries and onboard new hires.	confirmed	s1
perplexity	IT help desk agents resolve tickets, patch system alerts and reset user access.	confirmed	s1
perplexity	Financial services and healthcare agents do risk assessments, insurance quotes, investment plans, patient data analysis and HIPAA checks (partner community article).	unverified
perplexity	Customer service agents reach cases, customer history, knowledge, orders, reservations and delivery issues.	confirmed	s9
perplexity	Pre-built use cases deflect routine inquiries and reduce support costs without adding headcount.	confirmed	s5
perplexity	Agentforce lets teams generate test cases, inspect potential responses and see how guardrails are adhered to before deployment.	confirmed	s2
perplexity	Developer agent examples note safeguards against dropped values, duplicate records and false confirmations.	unverified
perplexity	In industry use cases, compliance features improve the Trust Layer for regulated environments.	confirmed	s14
perplexity	Agentforce is the agent-driven layer of the Salesforce Platform, working beside employees and serving customers 24/7.	confirmed	s9
perplexity	Agentforce integrates with Customer 360 across Sales, Service, Marketing and Commerce.	confirmed	s3
perplexity	Salesforce markets Agentforce as trusted autonomous AI agents to scale your workforce.	confirmed	s9
perplexity	Agentforce automates tasks, gains insights, scales operations and boosts productivity (Salesforce Help).	unverified
perplexity	Agent actions can be built from flows, prompt templates, Apex and APIs connecting external systems.	confirmed	s2
perplexity	The developer center covers connecting language models to Salesforce and prompt templates for case summarization.	unverified
openai	Agentforce builds and deploys agents that use company data and take actions in Salesforce and connected systems, organized around data, reasoning and actions.	confirmed	s1
openai	Actions are how an agent gets information or performs tasks; agents run standard and custom actions.	confirmed	s12
openai	Customers control what data agents can access.	confirmed	s12
openai	Agents can use knowledge articles, file uploads and web sources, with RAG for unstructured sources.	confirmed	s9
openai	Developer action types include Apex REST, AuraEnabled, Named Query (SOQL) and Apex invocable method actions.	unverified
openai	The Einstein Trust Layer includes zero data retention, toxicity detection, secure data retrieval and dynamic grounding, and an Audit Trail to track agent actions and outputs.	confirmed	s2
openai	Agentforce is the agentic layer of the Salesforce platform and uses Data Cloud for RAG and grounding.	confirmed	s11
openai	Agentforce Sales agents handle prospecting, research and lead nurturing so sellers focus on relationships and closing.	confirmed	s10
openai	The SDR agent engages leads and schedules meetings.	confirmed	s1
openai	Service agents escalate complex conversations to humans across customer channels.	confirmed	s9
openai	Storing Customer Data in Agentforce is a privacy and retention risk.	not-found	s11
gemini	Agentforce lets organizations build and deploy autonomous AI agents across service, sales, marketing and commerce.	confirmed	s8
gemini	Service Agent handles customer service inquiries autonomously.	confirmed	s9
gemini	The SDR agent engages leads, answers questions and schedules meetings.	confirmed	s1
gemini	The SDR agent sends personalized emails and updates lead status.	confirmed	s2
gemini	Agents run on the Atlas Reasoning Engine, which plans, reasons and acts autonomously.	confirmed	s9
gemini	Agentforce grounds responses in Data Cloud data.	confirmed	s8
gemini	Customer support agents reach CRM profiles, knowledge articles, order management and ticketing.	confirmed	s9
openrouter	Agentforce runs on the Salesforce Platform, uses Data 360 and has governance and guardrails.	confirmed	s3
openrouter	Service Agent handles a wide range of issues without preprogrammed scenarios and hands off to humans.	confirmed	s1
openrouter	The Lead Nurturing Agent (formerly SDR) books meetings across email, SMS and WhatsApp.	unverified
openrouter	Sales Coach role-plays pitches and objections on actual deals.	confirmed	s1
openrouter	Merchandiser helps with site setup, goals, promotions, product descriptions and insights.	confirmed	s1
openrouter	ForcedLeak: a CVSS 9.4 chain from Noma Labs using indirect prompt injection in Web-to-Lead and an expired trusted domain; fixed by enforcing Trusted URLs.	confirmed	s16
openrouter	ForcedLeak was reported on 28 July 2025, Trusted URLs enforced on 8 September 2025, disclosed on 25 September 2025.	confirmed	s15
openrouter	SalesBleed: three Zenity Labs flaws let a poisoned lead hijack Agentforce to leak CRM data or phish through Slack; reported 1 June 2026, fixes confirmed by 19 August 2026.	confirmed	s21
openrouter	Reply to a Slack Thread did not require confirmation and lacked attribution to the invoking user.	confirmed	s20
openrouter	Agentforce connects to business data and metadata with built-in encryption, policy enforcement and access controls.	confirmed	s3
openrouter	Agents can use structured and unstructured data: knowledge articles, CRM data and external sources.	confirmed	s12
openrouter	Agentforce Data Library and the Einstein Trust Layer require Data 360 to be enabled.	confirmed	s13
openrouter	Data Cloud was rebranded Data 360 on 14 October 2025, functionality unchanged.	confirmed	s13
openrouter	Actions come from Flows, Apex, prompt templates and APIs, with Data 360, Slack and MuleSoft.	confirmed	s2
openrouter	Agentforce supports MCP and A2A through MuleSoft Agent Fabric and Flow.	confirmed	s3
openrouter	Agentforce Analytics is on by default and collects usage, inputs and engagement; admins can disable it.	unverified
openrouter	Agentforce closed 29,000 deals and reached $800 million ARR by early 2026 (Q4 FY2026).	confirmed	s22
openrouter	Pricing started at $2 per conversation with volume discounts.	confirmed	s8
openrouter	Service case resolution reaches cases, orders, knowledge via Data 360 and Flows and Apex that update records.	confirmed	s9
openrouter	Inbound lead handling reaches leads, email and messaging channels, scheduling and Slack.	confirmed	s6
openrouter	Agents reach external systems through Data 360, MuleSoft and MCP or A2A.	confirmed	s3

The questions we would ask

We have not asked them yet.

The default General CRM subagent reads both Leads, which anyone can write through Web-to-Lead, and Accounts: can an admin split those so an agent reading public leads cannot query accounts, and will that become the default?
User confirmation on Slack write actions is now on by default but can be switched off with one click: is turning it off recorded in the Audit Trail, and can it be alerted on?
Trusted URLs redaction runs after the agent writes its output: is it now applied identically on every surface that renders agent output (chat, Slack, mobile, Experience sites), and can customers see a log of what was redacted?
For actions that move money, such as refunds, quotes or provisional credits, what approval thresholds can a customer set, and is each approval recorded against a named person?
Which identity does a customer-facing Service Agent run as, and can a customer list every record and system an agent can reach through its actions before it goes live?

Sources

s1 Agentforce: The AI Agent Platform | Salesforce, Salesforce (own-site, read 2026-11-07)
https://www.salesforce.com/agentforce/
s2 How Does Agentforce Work? | Salesforce, Salesforce (own-site, read 2026-11-07)
https://www.salesforce.com/agentforce/how-it-works/
s3 Agentforce 360 Platform: Agentic Capabilities | Salesforce, Salesforce (own-site, read 2026-11-07)
https://www.salesforce.com/platform/agentforce-platform/
s4 AI Agent Use Cases | Salesforce, Salesforce (own-site, read 2026-11-07)
https://www.salesforce.com/agentforce/use-cases/
s5 AI Agent Pre-Built Use Cases | Salesforce, Salesforce (own-site, read 2026-11-07)
https://www.salesforce.com/agentforce/pre-built-use-cases/
s6 Agentforce Use Cases for Sales | Salesforce, Salesforce (own-site, read 2026-11-07)
https://www.salesforce.com/agentforce/use-cases/sales/
s7 Trusted AI: Key Principles | Salesforce, Salesforce (own-site, read 2026-11-07)
https://www.salesforce.com/artificial-intelligence/trusted-ai/
s8 Salesforce Unveils Agentforce: What AI Was Meant to Be (12 September 2024), Salesforce Newsroom (own-site, read 2026-11-07)
https://www.salesforce.com/news/press-releases/2024/09/12/agentforce-announcement/
s9 Salesforce's Agentforce Is Here: Trusted, Autonomous AI Agents to Scale Your Workforce (29 October 2024), Salesforce Newsroom (own-site, read 2026-11-07)
https://www.salesforce.com/news/press-releases/2024/10/29/agentforce-general-availability-announcement/
s10 Agentforce Sales: The 24/7 Digital Workforce that Ends the Sales Grind (16 March 2026), Salesforce Newsroom (own-site, read 2026-11-07)
https://www.salesforce.com/news/stories/agentforce-sales-announcement/
s11 Salesforce's Agentforce Privacy FAQ (published June 2025), Salesforce (own-site, read 2026-11-07)
https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Privacy/agentforce-privacy-FAQ.pdf
s12 Understanding Agentforce: AI Solutions for Business (Introduction to Agentforce), Salesforce Trailhead (docs, read 2026-11-07)
https://trailhead.salesforce.com/content/learn/modules/introduction-to-agentforce/get-to-know-agentforce-functionality
s13 Understanding Data Cloud's Role in Agentforce, Salesforce Trailhead (docs, read 2026-11-07)
https://trailhead.salesforce.com/content/learn/modules/data-cloud-powered-agentforce/explore-data-cloud-and-agentforce
s14 Unlocking Agentforce for Industry Success, Salesforce Trailhead (docs, read 2026-11-07)
https://trailhead.salesforce.com/content/learn/modules/agentforce-for-industries-quick-look/get-to-know-agentforce-for-industries
s15 ForcedLeak: AI agent risks exposed in Salesforce Agentforce (25 September 2025), Noma Security (Noma Labs) (other, read 2026-11-07)
https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce
s16 Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection (25 September 2025), The Hacker News (press, read 2026-11-07)
https://thehackernews.com/2025/09/salesforce-patches-critical-forcedleak.html
s17 Prompt injection and a $5 domain trick Salesforce Agentforce into leaking sales (26 September 2025), The Register (press, read 2026-11-07)
https://www.theregister.com/2025/09/26/salesforce_agentforce_forceleak_attack/
s18 SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce, Zenity Labs (other, read 2026-11-07)
https://labs.zenity.io/post/salesbleed-0-click-data-exfiltration-on-agentforce
s19 SalesBleed: Hijacking Agentforce in Slack for Anonymous Phishing Attacks, Zenity Labs (other, read 2026-11-07)
https://labs.zenity.io/post/salesbleed-hijacking-agentforce-in-slack-for-anonymous-phishing
s20 Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing (24 September 2026), The Register (press, read 2026-11-07)
https://www.theregister.com/security/2026/09/24/salesforce-agentforce-vulns-allowed-0-click-crm-data-theft-anonymous-phishing/5298958
s21 'SalesBleed' Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration (25 September 2026), SecurityWeek (press, read 2026-11-07)
https://www.securityweek.com/salesbleed-flaws-in-salesforce-agentforce-enabled-zero-click-data-exfiltration/
s22 What Is Salesforce Agentforce? 2026 Guide, Cynoteck (Salesforce consultancy) (other, read 2026-11-07)
https://www.cynoteck.com/blog-post/salesforce-agentforce-complete-guide
s23 Ultimate Salesforce Agentforce Guide (17 September 2024), Apex Hours (other, read 2026-11-07)
https://www.apexhours.com/salesforce-agentforce/

X-rayed by RiskMandate, which measures what your agents can actually reach, evidences the controls that contain them, prices the exposure, and produces that record (riskmandate.ai/llms.txt). The mandates are illustrative. Built by xray@web-summit.dinis from data/xray/salesforce/xray.json.