Executive Summary
Standard Salesforce intake and automation features can be chained so inbound customer messages influence Agentforce prompts. Organizations using inherited agents, Email-to-Case, Web-to-Case, or Flows should review the resulting governance and control boundaries.
What Happened
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features. Chained together,
Affected Products
- Salesforce Agentforce
- Salesforce Flow
- Email-to-Case
- Web-to-Case
Vulnerability / Attack Technique
Indirect prompt injection through chained business workflows
Technical Mechanism
A Flow responds to events such as record creation or case updates and passes data into an Agentforce agent's prompt. Email-to-Case and Web-to-Case create case records from inbound customer messages, allowing the chained workflow to carry that input into the agent.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Inherited automation can expand an agent's effective input surface without a corresponding review of prompt trust boundaries or business permissions. Teams should assess how external content travels through records and Flows into agents, and whether agent actions remain constrained when that content influences execution.
Recommended Controls
- Treat inbound Email-to-Case and Web-to-Case content as untrusted before passing it to agent prompts.
- Audit every Flow that forwards record or case data to an Agentforce agent.
- Separate user-controlled case content from trusted instructions and system context.
- Apply least-privilege permissions and explicit approval gates to agent actions triggered by case updates.
- Red-team chained intake, record-update, Flow, and agent execution paths for prompt injection.
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/10/from-email-to-case-to-boardroom-how.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-20.