Inherited AI Agents Can Open a Door From the Public Internet to Your Internal Systems

Researchers documented in August 2026 how two standard Salesforce features can combine into a risky path. Agentforce agents can be triggered by a Flow when a case record is created or updated, while Email-to-Case turns inbound customer emails into case records. Chained together, an unauthenticated outsider can send an email that ends up in an internal agent's prompt, and the agent's reply goes back out the same route. The source stresses that nothing was misconfigured; every feature worked as designed.

The article argues that agents fail through the application around them, not the model inside them. Which intake features are on, which triggers fire, which objects guest users can see, and where untrusted data is passed all decide whether the risk is a nuisance or a data exposure. A vendor review done at purchase misses this, because the agent did not exist then. Prompt filters also cannot tell that an input came from a stranger, since they do not understand Email-to-Case. The City-Forum campaign, an active worldwide data-theft operation against Salesforce and ServiceNow instances since March 2025, was found in this same gap between platform features and real configurations.

The piece also warns about shadow agents. Platforms make building agents as easy as making a slide deck, and teams such as marketing and finance create agents that run with their creator's permissions. That is an employee's access, running unattended and multiplied across everything they were ever granted.