Salesforce Agentforce intake can pass public email into agent prompts
Original title: From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software
Researchers say standard Email-to-Case and Flows can reach agent actions without a misconfiguration.
The Hacker News describes an August 2026 research finding that Salesforce Agentforce, Email-to-Case or Web-to-Case, and Flows can chain so an unauthenticated outsider’s message becomes a case, enters an agent prompt, and can drive an action and outbound reply. The article argues inherited agents evade procurement reviews and prompt filters that do not understand intake features. It also cites the City-Forum data-theft campaign against Salesforce and ServiceNow instances since March 2025, and OWASP’s Agentic Skills Top 10 “No Governance” category.
Unconfirmed: The article does not say attackers have used this Agentforce email-to-prompt chain in real incidents.
- The described path ends in a case comment and an outbound reply.
- City-Forum has run since March 2025 against Salesforce and ServiceNow.
- OWASP says third-party platform skills are unreachable by external scanners.
- Cited EU AI Act penalties reach €35 million or 7% of global turnover.
Impact: Outsider email can reach an internal agent’s prompt and actions
| Product | Affected |
|---|---|
| Salesforce Agentforce | — |
- 1.Review Email-to-Case and Web-to-Case flows that pass case data into agent prompts.
- 2.Inventory agents, owners, and guest-user objects wired to agent triggers.
- Vendors
- Salesforce
- Products
- AgentforceServiceNow
- Threat actors
- City-Forum
- Organizations
- OWASP
From the original article
5 min read at thehackernews.com
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.