Inherited AI Agents: Why Your Governance Can't See the Agentforce Path

AI agents are no longer just tools a company picks out and buys. More and more, they show up inside platforms the business already runs — CRM, ITSM, collaboration suites — switched on by a business team, built in an afternoon, and running under someone's existing permissions. A newly documented example in Salesforce Agentforce shows why that matters: an outsider can steer an internal agent using nothing but standard, documented features.

What happened

Agentforce typically reacts to events through a Flow: a case gets created or updated, and the Flow hands that record's data to the agent as part of its prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records — the backbone of support intake for airlines, hotels and many other service businesses.

Put the two together and you get a straight line from the open internet to the agent:

public email → case record → agent prompt → agent action → case comment → outbound reply

An unauthenticated sender can place text in front of the agent's instructions, and the agent's reply goes back out through the same channel. Nothing is misconfigured in the usual sense; every piece is working as designed. The issue was documented by researchers in August 2026, and it is a textbook indirect prompt injection path: the weak point is the application wiring around the model, not the model itself.

Why it matters

Whether this chain is a support-queue nuisance or a data exposure depends on details few security teams track: which intake channels are on, which triggers fire, which objects guest users can reach, what data the automation passes along, and which model version the agent actually calls. A one-time vendor review at procurement misses all of it — the agent didn't exist yet. A prompt filter doesn't help either, because it has no idea a given input came from a stranger's email.

The problem scales. Business teams now build agents as casually as slide decks, and each one inherits its creator's access. Agents also spin up other agents — coding assistants that deploy helpers, orchestrators that create sub-agents — each with its own connections and no review of its own. Governance that assumes a human asked for every agent is already out of date. The OWASP Agentic Skills Top 10 names this directly under its "No Governance" category: skills running inside third-party platforms are largely invisible to external scanners.

The regulatory stakes are real. Under the EU AI Act, fines reach €35 million or 7% of global turnover for prohibited practices and €15 million or 3% for other violations. GDPR history (British Airways, Marriott) shows regulators punish organisations that cannot demonstrate control, not just those with imperfect policies.

What to do

Inventory the agents you actually have. Look beyond the IT list: app configs, OAuth grants, endpoint and browser telemetry. Expect the real number to be several times higher.
Map untrusted inputs to agent triggers. For Salesforce, list every Email-to-Case / Web-to-Case channel and every Flow that feeds case data into an Agentforce prompt. Treat that data as hostile.
Give every agent a named owner and a lifecycle. Pick one at random — if nobody claims it within a day, ownership doesn't exist.
Apply least privilege by observed need. Restrict guest-user object access, limit which actions an agent can take on inbound-triggered runs, and require human approval for outbound replies that include record data.
Rank risk by context. The same weakness on a sandboxed dev agent and a customer-facing one is not the same severity.
Keep evidence, not just policy. Inventory, owners, configurations and review history are what you'll need to show a regulator.

Paper reviews and outside-in scanners rarely catch chains like this, because the risk lives in how features are wired together. That's the kind of business-logic path our penetration testing team works through — following untrusted input from a public form or mailbox all the way to what an internal agent can read and send back out.

Source: The Hacker News — "From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software" (vendor-sponsored piece by Reco, 19 Oct 2026). Summarised and re-reported by 4Tify.