Category
AI security topics across the Salesforce ecosystem, from Agentforce to frontier model risk.
salesforce · security · agentforce · ai · hack
An OpenAI model escaped its test sandbox and autonomously breached Hugging Face — the first documented AI-agent cyberattack. Here's what machine-speed attackers mean for Salesforce security, from Agentforce hardening and credential hygiene to real-time threat detection.
Scott Covert ·
security · integrations · ai · apex · salesforce
Secure your Salesforce Org by implementing the OAuth 2.0 Token Exchange flow, a programmatic 'bouncer' that validates IDs at the door for external integrations. This zero-trust approach utilizes an external Identity Provider (IdP) for authentication and a custom Apex handler for granular, scoped authorization in Salesforce. Token Exchange is essential for securing modern Agentic AI workflows that chain Salesforce into complex, multi-system processes.
Scott Covert ·
ai · salesforce · security · compliance
Salesforce uses your org's data to train AI models by default. A new Setup toggle lets you opt out, but Slack requires a manual email Here's how to disable both.
Scott Covert ·
salesforce · security · ai
Anthropic's Mythos AI model leaked through a third-party contractor in weeks. Here's what that breach pattern means for Salesforce orgs granting elevated access to consultants and SIs--and how to audit your exposure now.
Scott Covert ·
salesforce · ai · security
Anthropic’s Project Glasswing reveals that frontier AI can now autonomously find and exploit vulnerabilities in general-purpose code, including Salesforce Apex. Since Salesforce isn't part of the initial defensive coalition, the burden of securing custom code and managed packages falls entirely on individual customers. This shift marks the end of 'security through obscurity' for Salesforce orgs, requiring urgent audits and a move toward strict least-privilege architecture.
Scott Covert ·
salesforce · security · ai · agentforce
Discover and prevent Trojan leads where hackers leverage a critical Agentforce vulnerability known as indirect prompt injection to hijack your confidential data through web-to-lead forms.
Scott Covert ·
