Inherited Agents Expose Governance Gaps in Enterprise AI Deployments

The City-Forum campaign, an active worldwide data-theft operation against Salesforce and ServiceNow instances, has been running since March 2025.

Salesforce Agentforce and the Email-to-Case chain

Researchers documented in August 2026 a concrete path that turns public-facing intake systems into an entry point for internal agents. In Salesforce Agentforce, the recommended integration pattern is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Chained together, those pieces create a single sequence:

public internet → email → case record → agent prompt → agent action → case comment → outbound reply

The sequence is not an exploit in the technical-vulnerability sense; it is a configuration and a supported, documented feature set. Yet the single route described above lets "an unauthenticated outsider" feed instructions into an internal agent and receive replies through the same outward-facing channel—without any misconfiguration, according to the researchers' finding.

Why inherited agents break governance built for software

The core lesson in the finding is directional: agents fail because of the application that hosts them, not because of the model inside them. Which intake features are enabled, which triggers fire, which objects are exposed to guest users, which automation passes untrusted data where, and which model version the agent is quietly calling underneath—these are the variables that decide whether an Agentforce chain is a benign support-queue nuisance or a data-exposure pathway.

Crucially, a vendor risk review performed once at procurement sees none of those variables, because the agent did not exist at procurement. A prompt filter watching the agent's inputs does not know that a particular input originated from a stranger, because prompt filters do not understand Email-to-Case. Securing an inherited agent therefore means understanding its host application at the depth its own administrators do; that depth is the one thing a questionnaire and a scanner both lack.

City-Forum campaign, shadow agents, and multiplication of builders

The City-Forum campaign occupies the exact territory this visibility gap creates: the gap between platform features and the configurations enterprises actually run. The report frames another operational problem in plain language: platforms have made agent creation as accessible as making a slide deck. Marketing builds an agent to pull pipeline reports; finance builds one to reconcile invoices. Each rides its creator's permissions, because that is what makes it useful.

Shadow AI—once an employee pasting data into a chatbot—has a new analog in shadow agents: an agent that runs with the access of the employee who created it, unattended and multiplied across everything that account was ever granted. The problem compounds when agents build agents: a coding agent tagged into a chat channel can scaffold and deploy another agent as easily as it opens a pull request; an orchestration platform spins up sub-agents to divide a task, each with its own connections and none with its own review. Any governance model that assumes a human requested each agent is quietly obsolete.

OWASP Agentic Skills Top 10 and tool blind spots

The governance gap is now described in industry terms: the OWASP Agentic Skills Top 10 whitepaper lists "No Governance" as the sharpest version of that gap. A skill deployed and managed inside a third-party platform is unreachable by external scanners, the paper warns—meaning the tools an enterprise points at the problem from outside cannot see inside the venues where most agents live. Governance fails most often because the rules get written before the security team can see the things the rules apply to.

EU AI Act, GDPR precedents, and the cost of paper compliance

Regulators are not theoretical here. The EU AI Act carries penalties that converge on GDPR-level weight: up to €35 million or 7% of global annual turnover for prohibited practices, and up to €15 million or 3% for other violations. The report draws a direct line to GDPR enforcement history: British Airways and Marriott were fined under GDPR—£20 million and £18.4 million respectively—not for imperfect policies but because compliance existed on paper and could not be evidenced operationally when regulators asked. A governance practice built bottom-up generates that evidence as a byproduct: the inventory, the owners, the configurations, the review history.

Some platforms, the researchers note, are designed to produce exactly that record. Reco is cited as an example: it discovers agents across multiple vantage points, including the ones that never touch SSO, and assigns each a risk profile before any policy can be applied to it. Chapters 1 to 3 of Into the Expanse cover the shift, the three launch vectors, and the governance practice in full at the link provided by the authors.

What this means for technologists, procurement leaders, and regulators

• Technologists and security teams: visibility wins. The report argues teams must inspect host applications at admin depth, not rely solely on perimeter scanners or universal prompt filters that do not parse Email-to-Case or platform-specific flows.
• Procurement and risk reviewers: static vendor checks are incomplete. Because agents often did not exist at procurement, a one-time vendor review will miss the operational configurations that matter.
• Regulators and compliance officers: paper policies are not enough. The EU AI Act and GDPR precedents show enforcement focuses on operational evidence—inventory, owners, configurations—not just written principles.

The Agentforce chain at the top of this article is not an exploit. It is a configuration, and configurations are governable, provided someone can see them.

Original story