As artificial intelligence coding tools are rapidly adopted, development teams are able to develop software more quickly, however, cybersecu...
Salesforce is preparing for a future in which employees may no longer need to open Salesforce to use it.
At TDX 2026, CEO Marc Benioff described the shift with the line, “Our API is the UI,” as the company introduced Headless 360. The platform makes Salesforce capabilities, including Customer 360, Agentforce and Slack, accessible through APIs, Model Context Protocol (MCP) tools and command-line interfaces (CLI), allowing applications and AI agents to interact with Salesforce without relying on its traditional browser interface. Salesforce says its Headless 360 MCP server can support operations including querying and updating records, managing permissions, working with Apex and interacting with platform events.
The change challenges a model Salesforce spent decades building: software operated primarily by humans through screens and sold largely through user-based licensing.
If an AI agent performs the work, the traditional per-seat model becomes harder to justify. An agent does not need a dashboard or training programme in the same way an employee does. It needs authenticated access to data, tools and workflows.
Salesforce is already experimenting with consumption-based pricing. Its Agentforce model includes Flex Credits, which customers can use for agent actions, alongside conversation-based and user-based pricing. Salesforce lists 100,000 Flex Credits at $500, while certain Agentforce services can also be priced according to successful outcomes.
That transition could also affect the Salesforce consulting ecosystem. Implementation work historically centred on configuring screens, workflows and processes for employees. As agents take over more workflows, organizations may instead spend more on data quality, permissions, API architecture, agent governance and testing.
Salesforce has a reason to disrupt itself before competitors do.
AI-native platforms can be designed around APIs and autonomous agents without inheriting the assumptions of traditional enterprise software. By opening Salesforce to agents, the company is betting that its strongest asset is not the interface but the business data, permissions and workflows underneath it.
That makes governance a central part of the strategy.
Salesforce's Einstein Trust Layer is designed to keep Agentforce grounded in enterprise data while respecting existing access controls. Salesforce describes capabilities including dynamic grounding, secure data retrieval, auditability and zero-data-retention arrangements with external model providers.
But making Salesforce accessible through MCP and external AI systems creates another risk: the company no longer fully controls the interface through which users interact with its platform.
A sales manager could eventually ask an external AI agent to analyse pipeline data, update opportunities, trigger Salesforce workflows and coordinate information across Slack, Salesforce and other enterprise systems. The AI layer becomes the operating interface while Salesforce functions as the underlying system of record.
MCP also introduces new security considerations. Research has identified threats including tool poisoning and prompt injection, where malicious instructions embedded in tools or outputs can influence an agent's behaviour. The U.S. National Security Agency has similarly warned about cascading prompt-injection risks in MCP environments, where one agent's output can become another system's input.
The pricing problem remains unresolved as well. Agent actions vary enormously in complexity. Updating a contact record is not equivalent to autonomously completing a sales renewal, making a simple “pay per action” model difficult to align with business value.
Salesforce's Headless 360 strategy therefore represents more than a move away from browsers. It is a test of what enterprise software is worth when humans are no longer its primary operators.
Interfaces can be replaced. What is harder to replace is trusted business data, permission architecture, proprietary workflows and the infrastructure required to let autonomous systems act safely.
Salesforce is betting that those foundations will remain valuable.
The risk is that by making them accessible to external agents, it could also help those agents become the new interface between enterprises and Salesforce itself.
Joe Hladik, head of Zero Labs, the threat research division of Rubrik Inc., has spent years studying backup data, an area he believes remains relatively overlooked by the cybersecurity industry. This year, his team expanded its research to examine how organizations and employees are using AI assistants, beginning with Microsoft Copilot, which is used by around 20 million people and approximately 90% of Fortune 500 companies.
“No one’s looking at backup data,” Hladik said. “We found it to be a viable place to find actual intelligence to act upon.”
Hladik discussed the research with Krista Case during Black Hat USA in an interview broadcast by theCUBE, SiliconANGLE Media’s livestreaming studio. The conversation focused on Rubrik Zero Labs’ discovery involving Microsoft Copilot and the broader security implications for AI-powered agents.
Rubrik Zero Labs discovered the vulnerability in February and subsequently followed responsible disclosure procedures by notifying Microsoft. According to Hladik, Microsoft addressed the specific vulnerability by the middle of March.
Although the particular flaw has been patched, Hladik said the research demonstrated a broader technique that could potentially be relevant to other AI copilots. The method involved escaping Copilot’s isolated environment and reaching Azure’s backend infrastructure.
Researcher Ori Lahav is presenting the detailed findings at Black Hat USA.
“[That] would allow you to get command and control of probably hundreds, thousands, or much more, depending on the volume of what exists within that tenant of users’ files, SharePoint files, OneDrive, whatever,” Hladik said. “It’s a major, major find.”
The discovery also highlights the potential scale of an AI-related security incident. If an attacker were able to move beyond an AI assistant’s sandbox, access to organizational resources could potentially extend across files and other information stored within an enterprise environment.
The Copilot discovery comes as businesses rapidly deploy AI agents without necessarily having complete visibility into where those systems operate or what they can access.
Research from Rubrik Zero Labs found that only 23% of security leaders have complete visibility into the AI agents operating within their organizations. Rubrik is attempting to address this challenge through new AI agent governance capabilities introduced this week.
Hladik compared AI agents with technologies security teams have encountered before, arguing that their underlying architecture is not entirely unfamiliar.
“Agents are just bots with models,” Hladik said. “They’re a bot that asks a model, and then the model will tell them what to do, and then they act. It’s new, it’s cool, but at the same time, I’ve seen this before.”
The findings underscore a growing challenge for organizations deploying AI: securing not only the models themselves but also thwe environments, permissions, data and connected services that AI agents can interact with. As businesses increasingly integrate AI assistants into everyday workflows, vulnerabilities that allow these systems to escape their intended boundaries could create significant new attack surfaces.