Salesloft Drift: When an AI Chat Integration Became the Key to Hundreds of Salesforce Tenants
Key takeaways
- →In August 2025, a threat actor tracked by Google as UNC6395 used stolen OAuth tokens from the Salesloft Drift AI chat integration to export data from many customers' Salesforce instances.
- →This is injected AI in action: a trusted SaaS vendor's AI feature held standing, broad access inside customer tenants.
- →AgentGuard would have inventoried the integration as an AI Principal, scoped its expected behavior and blocked bulk exports that didn't match its task.
- 1
Drift AI integration granted OAuth access
- 2
Attacker steals integration tokens
- 3
Tokens used to query Salesforce at scale
AgentGuard blocks bulk queries outside the chat integration's normal task profile
- 4
Bulk data export, secrets harvested
- 5
Downstream cloud credentials abused
- Affected
- Salesforce customers using the Drift integration
- When
- August 2025
- Impact
- Bulk export of CRM records and secrets stored in them
What happened
Google Threat Intelligence reported that between roughly August 8 and 18, 2025, UNC6395 used compromised OAuth tokens tied to the Salesloft Drift application to run large-scale queries against customers' Salesforce instances. The attackers searched the exported data for credentials such as cloud access keys and passwords. Salesforce and Salesloft revoked tokens and removed the integration while the investigation ran.
Why this is an AI security failure
Drift was an AI chat product. Its integration was a non-human Principal with standing, broad authority inside customer CRMs, added by a vendor and rarely reviewed by the customer. That's exactly what we call injected AI: agentic capability that arrives through a trusted SaaS supplier and opens a path behind your back.
How AgentGuard would have stopped it
AgentGuard discovers SaaS-embedded AI integrations and treats them as AI Principals with an expected task profile. A chat assistant that syncs conversation records doesn't suddenly enumerate every object and export the case history in bulk.
- Injected-AI discovery across SaaS tenants and OAuth grants
- Behavioral task profile per integration
- Real-time block and token-revocation workflow on deviation
The lesson
Every incident in this series shares one root cause: an AI system acted with real authority, and nothing in the stack was checking whether that action made sense for its task, its Principal or its environment. That's the gap AgentGuard was built to close, with zero integration and deployment measured in days.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.