As reported by The Hacker News, researchers have documented a sobering class of vulnerability in enterprise AI agent platforms: when agents inherit their host application's data flows, they also inherit its attack surface. The specific example—Salesforce Agentforce chained with Email-to-Case—illustrates a problem that extends far beyond any single vendor.
The core issue is architectural, not a traditional software vulnerability. When a standard customer email becomes a case record, triggers a Flow, and feeds into an agent's prompt, an unauthenticated external user has a direct path into an internal agent's context window. The agent's reply exits through the same channel. Nothing is misconfigured. Every component works as designed. The failure is in the composition.
Why This Matters More Than a Single CVE
Traditional governance frameworks were built for software: you assess a vendor at procurement, deploy it, scan it periodically, and control configurations. Agents break this model fundamentally because they arrive inside platforms that were already approved. The agent didn't exist when the vendor risk assessment was completed. The prompt filter monitoring agent inputs has no concept of Email-to-Case origin—it sees data, not provenance.
The risk is in the application, and the application is the one thing nobody re-reviewed when the agent was added.
The Shadow Agent Problem
The Hacker News article identifies a critical escalation from shadow AI to shadow agents. When marketing operations builds an agent to pull pipeline reports, that agent inherits the creator's permissions—running unattended, with access multiplied across everything that user was ever granted. Worse, agents now build agents. A coding agent can scaffold and deploy sub-agents, each with its own scope and permissions, creating an uncontrolled proliferation that no governance framework was designed to handle.
The City-Forum Campaign: Proof of Concept in the Wild
The article references the City-Forum campaign, an active worldwide data-theft operation targeting Salesforce and ServiceNow instances since March 2025. This campaign operates precisely in the gap between platform features and actual enterprise configurations—exploiting not zero-days but the legitimate automation pathways that organizations have enabled without fully mapping their exposure.
Who Is at Risk
Shield53 Recommendations
Defenders must shift their focus from the agent to the application plumbing around it:
- Map agent data provenance: For every agent in production, trace every input source back to its origin. If any path terminates at an unauthenticated external user, treat that agent's prompt as externally reachable and apply input sanitization accordingly.
- Inventory agents like assets: Maintain a registry of every deployed agent, its creator, its inherited permissions, its data sources, and its action scope. Re-review this inventory quarterly. Agents built by agents must be captured automatically through platform audit logs.
- Implement provenance tagging: Where the platform supports it, tag inputs with their source (e.g., Email-to-Case vs. internal user) and configure agent behavior to apply stricter output controls when handling externally-originated data.
- Conduct composition reviews, not just vendor assessments: When a new agent is deployed on an existing platform, re-assess the platform's configuration—enabled intake features, active triggers, guest user object exposure, and automation chains—in the context of the agent's capabilities.
- Monitor for City-Forum indicators: Organizations running Salesforce or ServiceNow should engage their threat intelligence teams to identify IOCs associated with the City-Forum campaign and audit their instance configurations against known exploitation patterns.
- Constrain agent-to-agent creation: Disable or require explicit approval for any agent capability that allows spawning additional agents. Treat agent creation as a privileged action, not a routine workflow.
The governance gap The Hacker News identifies is not a patchable bug. It is a structural mismatch between how enterprises approve software and how AI agents actually deploy—silently, inside existing platforms, riding existing permissions, through existing data flows. Closing this gap requires defenders to understand their platforms at the depth of the admins who built them, not the depth of a procurement questionnaire. That is the uncomfortable standard inherited agents have set.
