AI agents that read customer emails can inherit risks nobody planned for

Researchers documented in August 2026 how an email from a total stranger can reach the instructions of an AI agent inside Salesforce Agentforce. No one broke a rule. Every feature involved is standard, documented and working as designed. The lesson is that the risk sits in how the pieces connect.

What changed

In Agentforce, the recommended way to make an agent react to events is a Flow. When a record is created or a case is updated, the Flow passes that data into the agent's prompt, which is its set of instructions. Separately, Email-to-Case and Web-to-Case turn incoming customer messages into case records. Airlines and hotels use them to run support.

Chain them together and the path runs from the public internet to an email, a case record, the agent's prompt, an agent action, a case comment and an outbound reply. An unauthenticated outsider gets a route into an internal agent, and the answer leaves through the same door.

Why it is hard to catch

A security review done when a company buys software cannot see this, because the agent did not exist then. A prompt filter does not know an input came from a stranger, because it does not understand Email-to-Case. The article says protecting an agent means understanding its host application as well as the platform's own admins do.

It points to the City-Forum campaign, an active worldwide data-theft operation against Salesforce and ServiceNow instances running since March 2025, as found in this same gap between platform features and real configurations.

Agents nobody planned

Platforms now make building an agent as easy as making a slide deck. Marketing builds one for pipeline reports. Finance builds one for invoices. Each runs with its creator's permissions. Some agents even build other agents, with no human asking for each one. Many companies have a governance document but cannot say how many agents are running, what they reach or who owns them.

What to do

• Treat any email or web form an agent reads as untrusted input.
• Keep a list of running agents, what each can reach and who owns it.
• Know which intake features and triggers are switched on in your platforms.
• Keep review history, so you can show regulators what you did.

The records matter. The EU AI Act allows fines of up to €35 million or 7% of global annual turnover for prohibited practices. Under GDPR, British Airways (£20 million) and Marriott (£18.4 million) were fined because compliance existed on paper but could not be shown in practice. The article ends by pointing to Reco, a security platform that finds agents and rates their risk.