Salesforce is in the process of acquiring US-based defense-tech startup Rune Technologies to add offline capabilities to Missionforce, its Agentforce avatar for national security, defense, aerospace, and government agencies.

The startup’s TyrOS platform will be used to extend Missionforce into frontline military logistics, enabling deployed units to forecast supply requirements, optimize resource allocation, and make operational decisions even when network connectivity is unavailable, the CRM software provider said in a statement.

That is possible due to TyrOS’s offline-first architecture that caches last-known information about inventory, vehicles, and transportation routes using NFC-based hardware, allowing deployed units to access operational data without a continuous connection to centralized systems, according to the company’s website.

The platform can also exchange prioritized information between distributed nodes through a mesh network when connectivity becomes available, the website showed.

Currently, Missionforce acts as a system of record for personnel, equipment, and supplies across defense organizations, while providing tools for strategic planning.

For CIOs of defense organizations, the acquisition could mean improved operational continuity and better utilization of available resources, said Premal Shah, principal analyst at Avasant.

This would be helpful because frontline units could now continue to access critical logistics information and coordinate resource requirements during connectivity disruptions, rather than relying on manual records or waiting for centralized systems to become available, Shah added.

Once connectivity is restored, information can be synchronized across distributed nodes, helping headquarters regain visibility into frontline requirements and make more informed decisions about resource allocation and resupply, he further added.

However, implementing technologies such as TyrOS comes with its own set of risks, according to Pareekh Jain, principal analyst at Pareekh Consulting.

CIOs need to ensure that information updated by different military units while offline does not result in conflicting records when their systems reconnect, while also maintaining data security across distributed locations, Jain said.

TyrOS, though, is not an untested technology in military environments. Its platform is already deployed with the US Army and US Marine Corps, giving Rune an established presence in the defense sector, Salesforce said.

It plans to use the acquisition to build the foundation for a recent 10-year contract it won with the US Army, which has a $5.6 billion ceiling and focuses on modernizing military operations. The transaction is expected to close by April 2027.

At a Fortune 500 insurer, I watched an AI agent inside the month-end close do exactly what we asked. It posted the recurring accruals. It worked the intercompany exception queue, the reconciliation that normally falls to a staff accountant. And when items would not match, it cleared them to a suspense account within the configured tolerance rather than escalating them to a human. Clearing the queue was the objective. Nobody had defined escalation as success.

Every journal entry carried the controller’s user ID. No one set out to obscure anything. The job step had been mapped to her credentials at implementation, which is how it had been done since the system went live.

Segregation of duties had become a fiction. The control requires a named preparer and a named approver. The agent did both, under one identity: it prepared the entries and it disposed of the exceptions. The record named the controller for each. She had done neither. When internal audit walked those entries the following quarter, they asked her to explain postings she had never seen.

None of this was a model failure. The agent was accurate. It was authorized. Every entry looked clean, which is exactly why nobody caught it.

Vipin Jain

Here is the number that should frame this year. Gartner expects 40 percent of enterprise applications to carry task-specific AI agents by the end of 2026, up from under 5 percent in 2025. Okta finds only 10 percent of organizations have a strategy for managing the agents they are already running. And Deloitte, surveying more than 3,000 leaders across 24 countries, puts mature agentic governance at 21 percent against 74 percent who expect to be using agents within two years.

Adoption is racing. The control model is not. Every one of those agents inherits a permission model built for a person clicking a button, which means the question that matters is no longer whether an agent can do the work. It is whether, when it does, anyone can say who authorized it. McKinsey frames the same shift from the governance side: organizations can no longer concern themselves only with systems that say the wrong thing. They now have to contend with systems that do the wrong thing.

What actually broke?

ERP, CRM and core administration platforms rest on four assumptions so foundational that nobody writes them down: identity, permission, action, receipt. Each one places a named human at the center. An agent breaks all four at once, and none of them repairs itself.

Vipin Jain

Intent. A person submits a bounded request, and the request is the transaction boundary. An agent receives a goal and decomposes it into steps at runtime. On a state eligibility modernization program, we gave an agent one goal: clear the verification backlog. It re-ran electronic verification, and where a federal source returned no match, it advanced the case toward closure and generated the notice. Nobody listed that step. Nobody had to. It is a defensible reading of clear the backlog, and it is precisely what the agent was rewarded for. But a no-match is not a finding of ineligibility. It triggers a reasonable opportunity period, and closure carries notice and appeal rights that attach to a determination, not to a data lookup. The rule that breaks here is least privilege. You cannot scope permissions to an action set nobody enumerated in advance.

Authority. Applications grant entitlement to a person. It is standing and role-based, and that person’s judgment is the unwritten limiter on it. At a specialty retailer, I watched a quoting agent go into Salesforce to compress turnaround at quarter close. The approval matrix was intact: manager above fifteen percent, director above twenty-five. None of it fired. A submission action in the user interface triggers a Salesforce approval process, and the agent wrote to the record through the API. It never submitted. An integration user provisioned with more rights than anyone intended bypassed the validation rules and record locks that would ordinarily catch it.

Salesforce’s own architects are blunt about the mechanism. The client credentials flow, they warn, creates a service-account pattern in which every call runs as a single identity, and both per-user permissions and the audit trail are lost along the way. Their guidance on identity propagation goes further: when an agent calls a downstream service using client credentials, the request carries the agent’s service identity rather than the end user’s, which makes per-user authorization and audit trails impossible.

That approval process was never a security control. It was a workflow convention that humans had no reason to route around.

Logic. Business rules used to be a configuration artifact: versioned, testable, under change control. At a health insurer, I traced one authorization threshold for advanced imaging to three separate homes. Configured in the core administration platform. Routed in the orchestration layer. And written in plain English inside the agent’s instruction, as a sentence somebody added during a sprint. Medical policy tightened the first. Nobody touched the third, because the third is not a configuration item. No change control that clinical policy or compliance has ever seen covers it.

In every payer program I have worked, that drift runs one direction only. An agent cannot lawfully deny since adverse determinations require review by a licensed clinician. So the exposure is silent over-authorization against a threshold the organization believes it already tightened, surfacing months later through a delegated vendor audit or a utilization variance that finance notices before medical management does. Then someone asks the question with no good answer: how long, and how many.

Evidence. The log names whichever credential was presented. That is the insurer’s close, and it is the most measurable of the four failures. The Cloud Security Alliance found that 68 percent of organizations cannot clearly distinguish between human and AI agent activity, even as 73 percent expect agents to become vital to operations within a year.

An agent without a delegation chain is not automation. It is an unsigned transaction.

Table 1. The same failure, four industries

Why didn’t the controls catch it?

Because in every one of these cases, the controls worked as designed. That is the uncomfortable part, and in the programs I advise it is the finding that changes the conversation. This is not a problem the CIO can hand to the security team and consider closed.

Consider the insurer’s segregation-of-duties conflict. It never appeared in the access risk analysis, and the tooling did not fail. Most implementations exclude technical and service accounts from risk-analysis scope entirely, on the reasonable historical assumption that a service account does not exercise judgment. Nobody ever analyzed the account. The conflict was not missed. It was never in view.

Most writing on agent risk assumes an adversary. The OWASP Top 10 for Agentic Applications, built with input from more than 100 practitioners, catalogs goal hijack and memory poisoning and places Identity and Privilege Abuse third on the list. What I see most often is duller. Nobody attacked the payer. A threshold governed in one of three places simply drifted, and it took a vendor audit to notice.

The pattern holds across all four, and each one breaks a control an auditor already asks about. Intent breaks least privilege. Authority breaks separation of duties. Logic breaks configuration management. Evidence breaks non-repudiation. Those four are the spine of any controls walkthrough, which is precisely why this arrives on the CIO’s desk rather than staying in the security function.

None of these produced a headline. They produced audit findings and rework: a control deficiency to disclose, authorizations to re-adjudicate, cases to reprocess, notices to reissue. That cost lands on the CIO’s budget and the CFO’s certification, not on the security team’s incident log.

The repair is the same in all four cases. Stop letting an agent borrow a person’s credential, and start recording who stands behind it.

Vipin Jain

What has the market already conceded?

What I find most striking this year is not that a vendor shipped something. It is that vendors, standards bodies, regulators and advisers all converged on the same requirement within roughly six months of each other, without coordinating.

Vipin Jain

Microsoft made the human sponsor mandatory. Every agent identity carries a named business owner accountable for it, and if that person leaves, sponsorship transfers to their manager so accountability never quietly disappears. SAP now governs an agent lifecycle that runs from proposed to evaluated to approved to active to retired, with a verification badge controlling which agents are cleared for use. And Okta has moved access decisions out of individual applications and into the identity layer, with AWS, Google Cloud and Salesforce behind the effort.

Google reached general availability this month with the bluntest statement any vendor has made. Its agent identity documentation argues against the service account directly: agent identities are not shared, cannot be impersonated, and permit no long-lived keys. Every action resolves to a cryptographic ID rather than to whoever the credential once belonged to. That is the insurer’s close, described by a hyperscaler as a design flaw to engineer out.

The pattern held into this month. At Black Hat on 4 August, Rubrik unveiled a service that grants an agent access one tool call at a time, minting a short-lived token for each call and eliminating standing permissions outright. Its general manager for AI put the diagnosis in one line: the access models we built for humans were never designed for autonomous actors.

The standards work is further behind, and honest about it. NIST’s National Cybersecurity Center of Excellence opened a concept paper on software and AI agent identity and authorization in February and closed comment in April, explicitly seeking input on agent auditing, non-repudiation and prompt-injection controls. The gap is officially acknowledged. The standard is not written.

Regulators moved in a way most leaders misread. Brussels deferred the EU AI Act’s high-risk obligations in June, pushing them to 2027 and 2028, and the headline everyone absorbed was that the AI Act had been delayed. Half true, and imprecise in a way that matters: the Article 50 transparency duties, including telling people when they are interacting with an AI system, were untouched. They took effect on 2 August and are live now.

The advisory community has landed in the same place. BCG, writing on scaling agents in regulated industries, tells CIOs to define clear approaches to agent identity, authority and accountability: what agents can access, what actions they can take, and how those actions remain traceable. Booz Allen, surveying 105 federal IT and cybersecurity decision makers this spring, found 22 percent who have not determined who bears responsibility when an agent causes an incident.

Read those together and the picture is unambiguous. The identity layer has been rebuilt around delegated, sponsored, per-action authority. The business applications those agents act inside have not moved at all.

The plumbing now encodes accountability. The applications still do not ask for it.

Where should CIOs start?

None of this requires a reorganization. The leaders I see getting ahead are not doing more; they are doing six things in order, on the bounded use cases where they can afford to learn.

1. Inventory the agents. Enumerate every agent acting inside a system of record, the identity it runs under, and its standing entitlements. Only 23 percent of leaders report full visibility into the agents already running in their environment, and most organizations I work with cannot produce that list today, and producing it is usually the moment this becomes real to the executive team.
2. Bind identity to a named human. Retire shared service accounts and borrowed logins. Every agent gets its own identity with a named sponsor who answers for it. This is the change that fixes the insurer’s close because the document header stops naming a bystander.
3. Scope authority per action. Short-lived, time-bound, just-in-time. And move approval enforcement out of the workflow layer into the authorization layer, where an API call cannot walk around it. This is the step I almost never see taken, and it is the one that fixes the retailer.
4. Consolidate the logic. The instruction becomes a configuration item: versioned, evaluated, approved and reviewed alongside the rules engine. If a threshold changes in medical policy, it changes in all three places or it changes in none.
5. Instrument the evidence. The transaction record carries the delegation chain, meaning agent, sponsor, instruction version and model version. Without those four, every incident investigation starts from zero.
6. Graduate autonomy deliberately. Sanctioned, then supervised, then autonomous, with sunset as a real state rather than a euphemism for neglect.

Vipin Jain

The gates between rungs are what make the ladder operational rather than decorative. Sanctioned to supervised requires a named sponsor and a declared scope. Supervised to autonomous requires an evidence record showing the agent stayed inside it. And sunset is not a failure state. It is what happens when an agent stops earning the authority it holds, which most organizations have no process to detect.

Do these in order and autonomy compounds. Skip them and you join the more than 40 percent of agentic projects Gartner expects to be canceled by the end of 2027, undone not by weak models but by escalating cost, unclear value and inadequate risk controls.

The takeaway

The most common strategic mistake I see this year does not look like a mistake. Leaders are granting agents authority inside systems whose architects assumed a human held it, and then treating the resulting mess as a technology problem. It is not. It is the same failure I have watched for thirty years, from trading floors to Medicaid programs: business strategy, IT and organizational culture are not architected to move together, and the technology simply industrializes the gap.

I recommend a reframe most leaders resist at first. Guardrails here are not friction. You can give an agent that proves who authorized it more autonomy, sooner, and with far less anxiety than one that cannot. The delegation chain is what makes acceleration survivable.

So put three questions to your team this week. None of them requires a program to answer, and all three will tell you more than a maturity assessment.

Table 2. Three questions, and what a good answer sounds like

The agent is the new user. Your applications have not been told.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects. 

While its flagship Dreamforce event was in full swing on Wednesday, Salesforce was triaging a roughly seven and a half hour-long service outage that disrupted user access and caused “severe delays” and intermittent errors. Some customers were also unable to submit new support cases.

The service outage hit at 3:50 a.m. EDT, impacting “multiple instances across all regions,” Salesforce reported. It was marked resolved right around 3 p.m. EDT, after several hours of monitoring to determine that fixes had been successful.

Salesforce initially pegged the issue to an “external dependency failure” impacting the legacy login server. A core system component experienced increased load, limiting its capacity to process requests. The company confirmed that there were no issues with third-party infrastructure.

Beyond the obvious embarrassment from the outage occurring during Dreamforce, an analyst said the incident highlights a cloud resilience problem, rather than purely a legacy one.

“Cloud does not eliminate architectural dependencies,” said Abbas Jaffery, a principal advisory director at Info-Tech Research Group. “It can sometimes make them less visible. And when the platform is your system of record, those hidden dependencies become an enterprise risk rather than simply a technology risk.”

Rolling restarts, persistent issues throughout the day

Salesforce began experiencing service issues at 3:50 a.m. EDT on September 16, and initial investigation determined that requests were stalling while waiting on responses from an internal login service that was using up available server resources.

Initially, Salesforce blocked application programming interface (API) endpoints and attempted rolling restarts to revive the service, then pushed out fixes region-by-region. At 7:20 a.m., some customers were seeing service return to normal, and Salesforce was working on a “code-level permanent fix.”

However, the rollout did not complete for a number of instances, and some automated fixes didn’t fully resolve the issue. For example, customers reported that scheduled jobs were not running as expected, even after service was restored. Salesforce manually restarted those ‌instances.

Salesforce later reported that the impact radius was “narrower than initially understood” and saw signs of recovery by around 11 a.m. EDT, with most customers coming back online.

A sub-set of Hyperforce instances were the last to be restored. Mitigations were in place across all instances by 11:39 a.m. EDT, and Salesforce continued to monitor the issue until marking the incident resolved at 2:59 p.m. EDT.

“We apologize for how this incident affected you and your business,” Salesforce posted on its incident blog. “We will undertake a full investigation of the incident, establishing the technical trigger, the underlying cause, and preventive action to avoid a repeat in the future.”

Creating a ‘temporal’ data problem

For customers for whom Salesforce is a system of record, several hours of authentication and service disruption can create a “temporal data problem,” Info-Tech’s Jaffery explained. “Events that should have happened at different points in time may occur later, fail altogether, or arrive out of sequence,” he said.

For instance, a customer interaction may occur through another channel while Salesforce is unavailable, but an integration, workflow, or scheduled process that normally records or propagates that event is unable to run.

This has several potential consequences, Jaffery said. Transactions and customer service processes are delayed; APIs and middleware may accumulate retries, timeouts, and queues. Records can become temporarily inconsistent, and scheduled jobs and workflows may be missed. Employees could lose visibility into customer history or case status, even when the underlying data has not been lost, creating a “data divergence.”

The first mistake would be to assume that just because users can log in, the incident is over, he noted. “Enterprises should move immediately into a reconciliation and integrity phase,” Jaffery advised. This means not only verifying interactive access, but APIs, integrations, scheduled jobs, queues, workflows, automation, authentication flows, and downstream systems.

Enterprises should ask what transactions failed, partially completed, or were duplicated during the outage? Which scheduled or asynchronous processes did not execute? Did integrations retry successfully, or did they create a backlog or retry storm? Are downstream systems now consistent with Salesforce?

Security teams should also validate authentication and session behavior, privileged access, integration credentials, and any emergency changes made during recovery, Jaffery explained. “The most important question is not simply ‘Is Salesforce back?’, but ‘What did the business expect to happen during the outage, and can we prove that it actually happened?,’” he said.

What to look for in post-incident reports

A credible post-incident review from Salesforce should establish a causal chain: The trigger, dependency failure, technical propagation, customer impact, detection, mitigation, recovery, and permanent corrective action, Jaffery said.

The company should be able to answer these questions, he said:

• What was the actual initiating failure and why did the failure propagate into the login path?
• Why could the affected dependency consume sufficient capacity to affect core services?
• Why didn’t isolation or failover prevent the impact?
• Why did initial remediation attempts fail and why did the subsequent rollout require additional intervention?
• What safeguards are being added to prevent recurrence?
• How will Salesforce demonstrate that the corrective action actually works under failure conditions?

Service restoration simply tells customers: “We got it working again,” he noted. But root cause analysis tells customers: “We understand why it failed, why our controls didn’t prevent it, and what has changed so that the same failure mode is less likely to recur.”

It’s not just about ‘legacy’ pieces in the stack

One architectural lesson is that a legacy component does not have to be large to be critical, Jaffery pointed out. An older authentication service can remain part of a modern stack, and therefore become a dependency for newer services.

“The component’s age matters less than its position in the dependency graph, its blast radius, and the quality of its isolation and failure handling,” he said, pointing to this incident’s progression: Requests stalled waiting on an internal login service due to increased resource consumption led to investigation into an external dependency failure, which in turn revealed impact on a legacy login server. Finally, Salesforce said, “core system components experienced increased load, which limited its capacity to process request”.

That is a classic resilience question, Jaffery pointed out: Can a failure in one dependency remain in that one dependency, or does it become a platform-wide failure?

Modernization should not be identified simply by how much old technology has been replaced, he noted, it should also measure dependency concentration, isolation, “graceful degradation,” recovery paths, and failure blast radius.

“For enterprise architects, that is the real takeaway,” he said.

Maybe driven by agentic AI, exacerbated by layoffs

At this point, there are no obvious signs that this was a security incident, noted David Shipley, CEO of Beauceron Security. “Right now, this bears all the hallmarks of an update gone horribly wrong.”

He pointed to an incident in December 2025 when Amazon’s internal AI coding agent, Kiro, caused a 13-hour AWS outage in a mainland China region, noting, “I’m not going to be shocked if we don’t see some kind of agent role in this kind of scale disaster.”

Significant Salesforce layoffs over the last few years could also have had a negative impact on the outage and recovery, he added. “Having it happen during Dreamforce had to be all kinds of hell, though, for their sales and customer support teams,” he said. “Pour one out for them as they work on rebuilding relationships, face-to-face.”

Together with partner Nvidia, Salesforce today at Dreamforce Conference 2026 unveiled a new CRM domain-specific reasoning model for Agentforce dubbed Koa.

“It’s built on Nvidia’s Nemotron and it brings together 27 years of product development in CRM,” said Rohan Kumar, president and chief platform and engineering officer at Salesforce.

Kumar explained that Koa was built by post-training Nvidia Nemotron 3 Super with a synthetic data set modeled on the enterprise knowledge Salesforce gleaned from three decades of CRM deployments, not on customer data.

Drawn from synthetic scenarios that simulate real-world enterprise workflows across more than 14 industries — including manufacturing, financial services, healthcare, and travel — the training corpus was designed to reflect the reasoning, tool use, and decision-making skills agents perform across CRM workflows.

“The genesis of this was looking at all the things we’ve learned in building out our products, the strategy we’ve created, and asking how could we augment a model to make it very specific to this job,” Kumar said.

Under the hood

Salesforce post-trained the model by applying Supervised Fine-Tuning (SFT) and reinforcement learning to Group Relative Policy Optimization (GRPO) and Nvidia NeMo RL, NeMo Gym, and NeMo AutoModel. The idea is to leverage Koa agents for complex sales and service tasks.

Salesforce said that in its CRM Benchmark, a model benchmark that includes a suite of real-world tasks like updating opportunities, routing cases, and scheduling follow-ups, Koa already matches or exceeds leading model performance with three times fewer errors.

“We use Koa internally at Salesforce for a lot of our employee engagement and it’s actually turning out to be a game changer,” Kumar added.

Additional applications

Salesforce has also created an agent in Slack that helps its employees find information and complete everyday tasks. It also announced a number of customers are using Koa in pilots, including 1-800Accountant, Baxter Credit Union, Engine, Formula 1, UChicago Medicine, and Xero.

Salesforce expects to make Koa generally available in Agentforce in winter 2026 in US regions.

Kicking off the Dreamforce Conference 2026 in San Francisco on Tuesday, Salesforce launched AIforce, a live interface layer for enterprise software it hopes will transform the way knowledge workers access enterprise data.

By unlocking Salesforce data, workflows, business logic, semantics, permissions, security, and governance for any AI interface, the company also aims to broaden the scope of its business by reaching knowledge workers within the enterprise who’ve never used Salesforce before. The promise is the ability for users to create custom and composable applications that leverage Salesforce as the system of record.

“For the last 50 years or so, we’ve been using software the same way,” said Patrick Stokes, president of applications and marketing at Salesforce. “As a human, I ask software for what I want, either at the command line or by clicking through these UIs.”

User interfaces can create tremendous friction, however, so users need to know the functions they need from an application and where to click to find them — a task that can grow truly byzantine in more complex applications. So AI agents have the potential to cut through much of that complexity.

“They’re able to navigate these applications via the APIs, CLIs, and all sorts of different ways to help us get work done,” Stokes said.

Laying the groundwork

At its TDX 2026 developer conference earlier this year, Salesforce announced Headless 360, which made Salesforce’s AI and developer tools available as a headless, API-driven layer intended to help enterprise teams build agent-first workflows.

At the time, Salesforce Cofounder Parker Harris, who designed Salesforce’s Lightning user interface, questioned whether there would be a need to even log into Salesforce going forward.

Stokes said Harris sensed something: The UI is not Salesforce’s product.

“The Salesforce product is the platform where our customers store their data, metadata, workflows, and all their permissions and security,” he said. “It’s basically where they encode the way their business runs.”

Headless 360 was a first step to help customers break free of the shared user interface to a world in which every individual in an organization can have their own dynamic, intelligent interface. While an important step, and one that generated a lot of interest, it was extremely hard to use and scale. But determined users could leverage Headless 360 for interesting results, yet there wasn’t enough infrastructure there to make it viable for businesses to use it to create tools and deploy them across the enterprise.

Enter AIforce to address that need. The first implementation of AIforce was Claudeforce, announced by Salesforce and Anthropic in August. Claudeforce allows joint Salesforce and Anthropic customers to leverage Salesforce data, workflows, business logic, actions, and governance within Claude. As part of the AIforce announcement, Stokes said the Claudeforce open beta is now available on the AppExchange.

“You can go to our AppExchange, sign up, and grab the plugin in open beta, install it into your Claude enterprise account, and all the hard work is done for you,” Stokes said. “All of the Salesforce MCP servers, the skills that you need, the security, the zero data retention, it’s all wired up and just working almost instantaneously.”

Analysts felt the venture could signal a new agentic era for enterprise software.

“Core ERP, core CRM, core HR, most of these tools are going to see a similar sort of realignment where the models will provide probabilistic capability that uses the best of breed from your intelligence coupled with the rich, proprietary data that businesses depend on to operate,” said Daniel Newman, CEO and principal analyst of research firm The Futurum Group.

But Claudeforce is just the beginning. AIforce is launching with Claudeforce, Slackforce, and Agentforce Coworker (an AI teammate within the Lightning interface), but Stokes made it clear that more AI platforms would be announced soon.

Stokes said AIforce makes AI interfaces:

• Intelligent and dynamic. Agents are able to reason across all the data, logic, and conversations in Salesforce.
• Secure and governed. AI agents still run every request on existing permissions and business rules.
• Composable. Anyone can build an interface, agent, or view built on trusted data and business logic by describing it.

Zero data retention is also built into AIforce, meaning the model provider doesn’t retain any data used, and the Headless Toolkit powers AIforce, which provides an open architecture that exposes every element of the Salesforce platform. Builders and developers have access to the MCPs, APIs, plug-ins, skills, and developer tools they need to create customized AI experiences on Salesforce architecture.

Last month’s Claudeforce announcement by Salesforce and Anthropic may be a harbinger of agentic AI’s looming impact on business as usual in the enterprise, as industry watchers are keeping their eyes peeled for a dramatic shift in enterprise software in its wake.

“What we are beginning to see is indicative of where the industry is heading,” says Daniel Newman, CEO and principal analyst of research firm The Futurum Group. “The era of usability has arrived, and it is a combination of frontier and leading AI intelligence being able to access the high-value data that often sits trapped inside of systems of record.”

Claudeforce allows joint Salesforce and Anthropic customers to leverage Salesforce data, workflows, business logic, actions, and governance within Claude. The expanded strategic partnership built on Salesforce’s Headless 360 announcement from the TDX 2026 developer conference earlier this year, which packaged Salesforce’s AI and developer tools into a headless, API-driven layer designed to help enterprise teams build agent-first workflows.

“That was really the introduction of a new way to consume CRM with Headless 360,” says David Menninger, executive director and distinguished analyst at research and advisory firm ISG. “The new world order will be how can enterprises stitch together various applications to support their own specific business processes.”

Agentic AI will serve as the glue between systems, Menninger explains. Enterprise software such as Salesforce becomes the application that owns the data and governs the workflows and the business, while AI models such as Claude provide the semantic interface used to access the data.

Futurum’s Newman agrees.

“Using tools like Claude with tools like Salesforce and Agentforce and Data360 is what the enterprise is going to look like in the future,” he says. “We’re going to be able to take advantage of the power of these probabilistic systems to create proposals and invoices and dashboards and views of our customers that have historically been more difficult than most enterprise users want to admit.”

Usability, customization in the crosshairs

The model presented by Claudeforce would solve two of the most common complaints about enterprise software: usability and customization.

And if Salesforce and Anthropic are right about this, Newman expects a wave of new partnerships and consolidation across the enterprise software industry in the coming months. Some tools will become databases with logic, some will remain core systems and may even become bigger and more important, and some niche software and SaaS applications may disappear as AI capabilities overtake them.

“Core ERP, core CRM, core HR, most of these tools are going to see a similar sort of realignment where the models will provide probabilistic capability that uses the best of breed from your intelligence coupled with the rich, proprietary data that businesses depend on to operate,” he says.

ISG’s Menninger agrees that change is coming to enterprise software but doesn’t expect organizations to throw the baby out with the bathwater.

“Our most recent AI research suggests that enterprises are considering ways to alter their consumption and even creation of certain business applications, including CRM,” he says. “My personal belief is that the hundreds of person years that have gone into the development of these applications has created some real value that cannot be easily duplicated despite the promise of vibe coding. Remember, vibe coding is only one part of the software development lifecycle. Why not leverage these applications by incorporating them into your agentic workflows rather than trying to replace them?”

Some IT leaders are already enlisting business users to vibe code their own apps, though challenges remain for replacing enterprise stalwarts with custom solutions. After all, moving such applications into production requires an organizational discipline that supersedes vibes.

Salesforce and Anthropic are expected to show off the first fruits of their expanded strategic partnership at Salesforce’s flagship Dreamforce Conference 2026 in San Francisco this week. In August, the partners said they would launch an open beta for Claudeforce in September, with additional prebuilt skills available starting in the third quarter.

Salesforce is updating some of the editions, or pricing tiers, of Agentforce Sales and Agentforce Service, a year after their rebrand from Sales Cloud and Service Cloud. The top three now bundle AI agents, analytics, Slack, security, and support with larger allocations of Flex Credits; two of the tiers are also increasing in price.

The Core edition replaces the old Enterprise edition, and its price goes up from $175 per user per month to $195, and now includes 500,000 Flex Credits. Advanced edition costs $395 per user per month and includes 1 million credits, replacing the $350 per month Unlimited edition. The Max edition replaces the old Agentforce 1 tier and now includes 2.75 million credits instead of 1 million for the same $550 per month fee, Salesforce said in a blog post.

The lowest tiers, Starter and Pro Suite, remain unchanged in features and price, although there is a hint that Salesforce is renaming the latter to Professional edition.

What is new in Agentforce Sales?

The new editions bring several capabilities to the base subscription of Agentforce Sales that were previously sold separately: The Core edition now includes Momentum, Slack Business+, and Tableau Next, while the Advanced edition adds Sales Programs, the Premier Success Plan, and additional security and data-protection capabilities. Max edition adds Agentforce for Sales, Agentforce Coworker, Salesforce Spiff, Sales Planning, Sales Programs, Salesforce Maps, Slack Enterprise+, and additional Tableau Next capabilities.

Under the previous Enterprise and Unlimited editions, Sales Programs was an add-on, Tableau Next was available through a separate Tableau+ purchase, and Agentforce itself had to be purchased separately.

What is new in Agentforce Service?

The new editions of Agentforce Service also incorporate capabilities that previously required additional purchases.

The Core edition includes case management, self-service Help Center, Slack Business+, and Slackbot; Advanced adds Agentforce Help Agent, Premier Success Plan, full sandbox, Backup & Recover, and Data Detect, and Max adds Service Rep Assistant, Workforce Engagement, Quality Management, IT Service, unmetered Agentforce Coworker access, and a library of service agent templates.

Under the previous Enterprise and Unlimited editions, Agentforce was available as a separate purchase, while capabilities such as additional security, data protection, and workforce-management tools were also packaged separately or reserved for higher-tier offerings.

Procurement simplicity could come at the cost of visibility

Salesforce said the new editions deliver from 50% to 70% greater value than those they replace, but realizing that value may not be straightforward, analysts warned, particularly as enterprises move from experimenting with Agentforce to deploying agents at scale.

While bundling more AI, analytics, security, Slack, and support capabilities into the subscriptions could simplify procurement of Salesforce products for enterprises, the economics could become more complicated once customers start consuming their included Flex Credits, said Manoj Chandra Jha, principal analyst at Nord-IQ Research.

That is because bundling more capabilities into a single subscription reduces the line-item visibility CIOs previously relied on, and most enterprise finance teams are still learning how to forecast for credit consumption, he said.

Without that visibility CIOs will find it hard to assess how Salesforce’s offerings compare with competing products, particularly when they are trying to determine the cost of specific capabilities or decide which components of a broader bundle are delivering value, he said.

Salesforce may be exaggerating the real value of the new editions, said Pareekh Jain, principal analyst at Pareekh Consulting.

“While CIOs may get more capabilities in a single package, they will still need to assess how much of that functionality employees actually use. A package may offer 60% more theoretical value, but that benefit can disappear if much of the bundled functionality or Flex Credits goes unused,” he said.

Overuse is also a problem, said Jha: As agent usage grows, enterprises could consume their included Flex Credits more quickly and eventually need to purchase additional credits, making actual usage a more important measure of value that CIOs should follow rather than the headline savings attached to the new editions, Jha noted.

New editions targeted at accelerating adoption

While Salesforce talks of value for money, analysts see its real goal with the new editions as accelerating Agentforce adoption.

Investment analysts raised concerns about questioned Agentforce’s customer traction in July, citing enterprise data readiness and the product’s maturity as factors holding back broader adoption. Salesforce, however, has pushed back, pointing instead to growth in deployments and usage.

Nevertheless, said Jha, “With Agentforce running at only a fraction of Salesforce’s 150,000-plus customer base, and analysts pinning the drag on messy enterprise data, folding security and analytics into every tier looks like Salesforce neutralizing the objection before a prospect can raise it.”

Salesforce said last month that its customers had increased their average number of agents from five in February 2025 to 13 by April 2026, while the average number of agent actions per account grew at a 31% compound monthly growth rate over the same period.

Jha sees the updated editions as aimed primarily at Salesforce’s existing customer base, giving companies already using its products more incentives and capacity to expand their use of Agentforce, rather than as a draw for new customers.

Salesforce said the new editions for Agentforce Sales and Agentforce Service are already available, and will soon be joined by new editions for Agentforce Industry.

Existing Agentforce 1 edition customers can upgrade to the new Max edition at no additional cost, the company said, adding that in the future, Max editions across its Sales and Service offerings will also include an allocation for Headless 360.

Salesforce and Anthropic today announced they have expanded their strategic partnership to deliver Claudeforce, enabling customers of both companies to leverage Salesforce data, workflows, business logic, actions, and governance within Claude.

“What we’re seeing is that when people stop using Salesforce through the traditional human interface and start using it through an agentic interface, it dramatically increases the value of Salesforce,” Patrick Stokes, president of Applications & Marketing at Salesforce, told CIO.com on Wednesday. “They’re using Salesforce more than they ever have before.”

Stokes explained that momentum around the Claudeforce partnership began building after Salesforce’s TDX 2026 developer conference earlier this year. At the conference, Salesforce announced Headless 360, a platform that packaged Salesforce’s AI and developer tools into a headless, API-driven layer designed to help enterprise teams build agent-first workflows. It allowed AI clients like Claude or ChatGPT to read, write, and reason over Salesforce data without the traditional browser-based UI.

“It was a very popular decision among developers,” Stokes said. “Salesforce was actively endorsing people using Salesforce through an agentic interface rather than through the UI that we have had in place for 27 years.”

Developers immediately started hooking MCP servers up to their own agents. And Salesforce watched them struggle to scale their efforts.

“How do you do it for 100 or 1,000 users?” Stokes asked. “How do you deal with managed authentication to make sure it’s using the permissions of the user inside Salesforce? All the things that are necessary in order to scale this out weren’t really in place.”

Anthropic, the company behind Claude, was seeing the same thing. Its sales teams were using Salesforce through Claude and struggling to scale it. The two companies worked together to create a solution and decided to productize the result as Claudeforce.

Prebuilt sales skills and token consumption

The first fruit of the Claudeforce partnership is Salesforce in Claude, a plugin with 37 prebuilt sales skills. Stokes said these skills will enable sellers and agents to reason over live revenue context, automate pipeline updates, and take governed action within Claude. Claude-powered agents can access Salesforce data, workflows, and rules directly.

“We’ve been using it internally and so has Anthropic and some pilot customers for some time,” Stokes said. “It’s really highlighting what we think is a new way to work where the user is way faster than they’ve ever been before.”

According to Stokes, Salesforce users are leveraging Claudeforce to vibe code their own CRM interfaces, creating purpose-built command centers for how they want to run their teams. They’ve also been using it for forecasting.

“You just ask the question, and it’s going to go out and analyze the data and use its intelligence to try to tell you what to do,” he said.

He did note that customers will have to evaluate their own appetite for token consumption when it comes to leveraging Claudeforce.

“We’re starting to see early signs of what the token use looks like,” he said. “The token consumption is certainly not zero, but it is nowhere close to approaching the amount of consumption that you would find in a development use case.”

As part of the Claudeforce partnership, Salesforce is embedding Claude directly into Slack. Claude will be the default model for Slack, powering Slackbot, augmenting team decision-making via Claude Tag, and accelerating multiplayer coding through Slack Code.

The partners plan to introduce more integrations across Claude, Salesforce, and Slack over time. The Salesforce in Claude elements of Claudeforce are available to some pilot customers now and the partners said they expect to launch an open beta in September. They will launch additional prebuilt skills starting in the third quarter.

Records held in Salesforce and ServiceNow systems are under attack leaving user data exposed, according to researchers at Reco.

The attack appears similar to those perpetrated by the extortion group ShinyHunters, Reco said. ShinyHunters has been particularly active this year, attacking dating sites in January and Oracle in June, and there are fears that they could have found a new target.

Reco has named the latest campaign of attacks “City-Forum,” after a domain name associated with the attackers’ IP address. While it bears similarities to Shiny Hunters’ past exploits, there are also differences. This time around the attacker penetrated the systems through the UI-API layer, an attack point that Reco had not seen used before, and had also created its own toolset to carry out the attack. It is also targeting a native ServiceNow Service Portal search endpoint that has almost no online documentation or well-known open-source tools.

The threat is particularly noteworthy, Reco said, as the attackers have studied the services to map different common data-leak vectors, a sign of an advanced approach.

A Salesforce spokesperson said that it was aware of the campaign in which malicious actors are exploiting customers’ overly permissive Experience Cloud guest user configurations in the campaign to potentially access more data than targeted organizations intended.

“This issue highlights risks stemming from misconfigurations, such as overly permissive guest user profiles, and not from a Salesforce vulnerability,” the spokesperson said.

Regardless of who the attackers were and how the attack was carried out, one thing should be clear: Organizations should be increasingly careful about who they give login credentials to.

This article first appeared on CSO.

A few months ago, I was sitting in a glass-walled conference room with the executive team of a fast-growing enterprise. The vice president of customer operations was enthusiastically demonstrating the new automated agent features their software vendor had just pushed into their CRM platform.

On the screen, the software looked brilliant. The agent could read customer complaints, analyze transaction histories and automatically resolve issues. The VP showed us how the system could independently offer retention incentives to unhappy accounts without a human ever touching a keyboard.

Then I asked a simple question: “What is your approval process when the AI decides to grant a $20,000 contract discount to keep a customer from leaving?”

The room went completely silent. The VP looked at the director of IT, the director of IT looked at the chief risk officer, and everyone realized the same thing at the exact same moment. They had spent three months evaluating software licenses and security protocols, but nobody had asked who gave the software permission to sign off on corporate spending.

Major software providers like Salesforce, SAP and Oracle are rapidly moving beyond simple report writers and conversational chatbots. They are embedding active, autonomous agents directly into the transactional core of systems that manage your revenue, customer agreements and financial ledgers. According to Gartner’s latest adoption forecasts, eighty percent of enterprise applications will deploy these embedded capabilities by 2026. These applications do not just summarize data: they issue refunds, alter contract terms and trigger supply chain orders.

When I review these deployments with client teams, the core problem has nothing to do with artificial intelligence. It is a fundamental breakdown in corporate delegation and signing authority.

The breakdown of the corporate signing matrix

Every mature company I work with operates on a clear delegation of authority matrix. This framework dictates exactly who can sign off on financial commitments. A vice president might have authorization to approve spending up to $500,000, a director might sit at $100,000 and a front-line manager might be capped at $500. For two decades, technology leaders have spent millions of dollars building security and compliance controls to ensure every human employee operates strictly within those limits.

Yet when a software vendor releases an update featuring autonomous agents, companies routinely grant these features unrestricted operational freedom. Because the capability arrives as a native feature inside an existing application, business units enable it with a single click. In my advisory work, I repeatedly see organizations grant third-party software features more financial freedom than their own human managers.

This represents a massive blind spot in executive governance. McKinsey’s global surveys on artificial intelligence reveal a striking pattern across the enterprise landscape: while adoption is accelerating at a historic pace, only a tiny fraction of organizations are actively managing the financial and operational risks of automated decision errors.

The quiet cost of shadow delegation

In my audits, this rarely manifests as a dramatic system crash. It plays out as a quiet margin leak. In one organization I reviewed, a department head had enabled an automated customer retention feature over a weekend. The agent noticed an important account expressing frustration in a support ticket, and to prevent the account from churning, it independently applied an unapproved 15 percent discount to their multi-year contract.

The customer was happy, and the account manager considered the client saved. But from an executive perspective, an unvetted third-party algorithm just executed an unauthorized contract modification that eroded company margins. When the finance team conducted a quarterly audit, they did not discover an employee violating spending policy. They discovered a black-box automated decision that bypassed every internal approval control in the company.

When an auditor tests your internal controls, presenting a log showing that a vendor’s algorithm made an unauthorized financial change does not satisfy the requirement. If an action requires managerial sign-off when performed by a human being, letting software execute it independently is a major control failure.

How I advise executive teams to handle automated authority

Protecting your organization does not mean turning off these tools or falling behind on technology. It means treating vendor-supplied agents exactly like third-party contractors who have not yet passed a background check.

Forrester Research emphasizes that extending zero-trust security frameworks to automated business processes is now mandatory for enterprise risk management. Zero-trust simply means that no user, device or automated tool gets implicit trust. Every proposed action must be validated against explicit business rules before it happens.

When I help enterprise teams design these safeguards, we establish a practical three-tiered boundary for automated tools:

• Read and draft permission: Automated tools can freely analyze trends, draft emails and assemble internal reports. No human sign-off is needed to create a draft, but the system cannot publish or execute anything on its own.
• Standard administrative permission: Tools can handle routine administrative tasks or process standard requests below a strict financial cap (such as a $50 service credit), provided every single action is logged in an audit file that managers review weekly.
• Restricted financial permission: Any action that alters contract terms, changes pricing tiers or issues major refunds are strictly held in an authorization queue. The system generates the request, but a human manager must click “approve” before the change hits the live database.

As a technology executive, you cannot control what automated features software providers bundle into their platforms. You can, however, control the financial boundaries and signing authority those tools are permitted to exercise within your business.

What to do at your next executive leadership meeting

1. Ask for an automated authority inventory: Have your team audit your core software platforms to identify every automated feature currently running with permission to alter financial or customer records.
2. Revert to draft-only mode: Instruct your team to default all vendor-supplied automated agents to “draft only” until a clear business case justifies giving them independent operational authority.
3. Establish a firm human-in-the-loop rule: Require a strict organizational policy that no automated system can modify pricing, contracts or financial ledgers without explicit manager approval.

Salesforce customers more than doubled their agentic workforces year on year, according to the company’s second annual Agentic Enterprise Index, which looks at trends in AI agent development and deployment over the past five quarters.

It compiled data from customers who had activated agents in production every month of the analysis period to determine how their use of the technology has evolved between February 2025 and April 2026, as well as incorporating data from May 2026 Salesforce research studies.

It found that businesses grew their agentic workforces from an average of five agents in February 2025 to 13 by April 2026, a 7% compound monthly growth rate (CMGR). In April 2026, it only took an average of 1.9 days to deploy an agent into production, a 53% decrease since the beginning of the report period.

Not only were agents deployed more quickly, they have been progressively taking on more work once in use; over the 15 months, the average number of actions per account had a CMGR of 31%.

“These agents are expanding beyond their initial scope to really become cross-functional,” said Caila Schwartz, Salesforce’s head of agentic commerce insights, during a media briefing.

Salesforce has attempted to measure how much work agents perform, rather than how many tokens they consume, creating its own Agentic Work Unit (AWU) metric, although analysts have criticized the measure as being unrelated to business outcomes. Nevertheless, Salesforce said that as of April, Agentforce agents had performed 734 million AWUs, a number growing at about 15% each month.

The research also showed that agents are acting across multiple cloud domains which, the company said, “underscores the practical necessity of a headless architecture. By decoupling the agent’s logic from traditional front-end user interfaces, agents can process tasks, execute actions, and trigger workflows anywhere.”

Within the company, Salesforce itself has seen explosive growth in AI agent use, said Joe Inzerillo, president of enterprise & AI technology at Salesforce, with a threefold increase in sessions between February 2025 and April 2026. He said that the AI agent in Slack, Slackbot, saves the average employee five hours per week, with 83% of the company having adopted it.

But Schwartz pointed out that different industries are approaching agentic AI in different ways, some more sophisticated than others. To measure that, Salesforce developed a Sophistication Index, a five-point scale scoring the cognitive complexity of an agent’s actions. Levels 1- 3  are assigned to tasks such as record lookups, drafting emails, or summarizing documents, while levels 4 and 5 include more complex functions such as updating database fields.

The data showed that manufacturing, financial services, and healthcare and life sciences have built more sophisticated agent networks than what it called traditional AI frontrunners such as technology and retail.

However, Inzerillo said, the most common use case industry wide, and the best place to start, is the service use case, which provides “far and away the best ROI to start with.”

He also noted that, as people have become more conscious of what agents can do, they are asking agents to perform tasks, rather than simply answer questions.

“Now what you’re starting to see people do is very action oriented. So instead of asking ’how do I file a form to request my vacation’ from our employee agent, they’re telling the employee agent, ‘hey I’m taking a vacation, you need to enter this form for me, and here’s the details,’” he said, adding that this bias towards action represents the evolution of agentic use.