Salesforce Agentforce Email-to-Case Flows Create Unauthenticated Prompt Paths
Inherited agents in platforms like Agentforce inherit all legacy automation surfaces, rendering procurement-time governance and external scanners ineffective. The gap documented by OWASP Agentic Skills Top 10 No Governance category and City-Forum telemetry shows that visibility requires host-application depth that vendors and questionnaires both lack. Bottom-up enumeration of enabled Flows, object permissions, and prompt origins is now the minimum operational control.
Thehackernews coverage correctly maps the Email-to-Case to Flow to agent chain but understates how long the configuration surface has existed. Procurement questionnaires from 2023-2024 never captured the trigger variables because the agent objects were not yet instantiated; the City-Forum operation, active since March 2025 per incident reports on ServiceNow and Salesforce tenants, exploited exactly these pre-existing intake paths rather than novel model flaws.
Salesforce: At least 12 percent of Agentforce tenants will report prompt-origin misrouting incidents by Q2 2027 once Flow audit logs are correlated with case creation sources.
Sources (3)
- [1]Primary Source(https://thehackernews.com/2026/10/from-email-to-case-to-boardroom-how.html)
- [2]OWASP Agentic Skills Top 10(https://owasp.github.io/www-project-agentic-skills-top-10/)
- [3]City-Forum Campaign Reporting(https://unit42.paloaltonetworks.com/city-forum-salesforce-servicenow/)