Salesforce is preparing for a future in which employees may no longer need to open Salesforce to use it.
At TDX 2026, CEO Marc Benioff described the shift with the line, “Our API is the UI,” as the company introduced Headless 360. The platform makes Salesforce capabilities, including Customer 360, Agentforce and Slack, accessible through APIs, Model Context Protocol (MCP) tools and command-line interfaces (CLI), allowing applications and AI agents to interact with Salesforce without relying on its traditional browser interface. Salesforce says its Headless 360 MCP server can support operations including querying and updating records, managing permissions, working with Apex and interacting with platform events.
The change challenges a model Salesforce spent decades building: software operated primarily by humans through screens and sold largely through user-based licensing.
If an AI agent performs the work, the traditional per-seat model becomes harder to justify. An agent does not need a dashboard or training programme in the same way an employee does. It needs authenticated access to data, tools and workflows.
Salesforce is already experimenting with consumption-based pricing. Its Agentforce model includes Flex Credits, which customers can use for agent actions, alongside conversation-based and user-based pricing. Salesforce lists 100,000 Flex Credits at $500, while certain Agentforce services can also be priced according to successful outcomes.
That transition could also affect the Salesforce consulting ecosystem. Implementation work historically centred on configuring screens, workflows and processes for employees. As agents take over more workflows, organizations may instead spend more on data quality, permissions, API architecture, agent governance and testing.
Salesforce has a reason to disrupt itself before competitors do.
AI-native platforms can be designed around APIs and autonomous agents without inheriting the assumptions of traditional enterprise software. By opening Salesforce to agents, the company is betting that its strongest asset is not the interface but the business data, permissions and workflows underneath it.
That makes governance a central part of the strategy.
Salesforce's Einstein Trust Layer is designed to keep Agentforce grounded in enterprise data while respecting existing access controls. Salesforce describes capabilities including dynamic grounding, secure data retrieval, auditability and zero-data-retention arrangements with external model providers.
But making Salesforce accessible through MCP and external AI systems creates another risk: the company no longer fully controls the interface through which users interact with its platform.
A sales manager could eventually ask an external AI agent to analyse pipeline data, update opportunities, trigger Salesforce workflows and coordinate information across Slack, Salesforce and other enterprise systems. The AI layer becomes the operating interface while Salesforce functions as the underlying system of record.
MCP also introduces new security considerations. Research has identified threats including tool poisoning and prompt injection, where malicious instructions embedded in tools or outputs can influence an agent's behaviour. The U.S. National Security Agency has similarly warned about cascading prompt-injection risks in MCP environments, where one agent's output can become another system's input.
The pricing problem remains unresolved as well. Agent actions vary enormously in complexity. Updating a contact record is not equivalent to autonomously completing a sales renewal, making a simple “pay per action” model difficult to align with business value.
Salesforce's Headless 360 strategy therefore represents more than a move away from browsers. It is a test of what enterprise software is worth when humans are no longer its primary operators.
Interfaces can be replaced. What is harder to replace is trusted business data, permission architecture, proprietary workflows and the infrastructure required to let autonomous systems act safely.
Salesforce is betting that those foundations will remain valuable.
The risk is that by making them accessible to external agents, it could also help those agents become the new interface between enterprises and Salesforce itself.