Einstein Service Agent — agentic threat model

Not certain from the listing — The specific foundation models powering the generative AI are not disclosed, though they likely run through the Salesforce Trust Layer. Primary threats include adversarial prompt injection to bypass guardrails and model reprogramming.

The agent is deeply integrated with Salesforce CRM data to ground its responses. This exposes a significant threat surface for data exfiltration, unauthorized access to sensitive customer PII, and potential knowledge-base poisoning if CRM records are manipulated.

The agent autonomously resolves issues without preprogrammed scenarios, implying dynamic tool execution and orchestration. Threats include tool misuse (e.g., unauthorized CRM updates or transactions) and insecure tool integration within the Salesforce ecosystem.

Not certain from the listing — The hosting environment is assumed to be the Salesforce Einstein 1 Platform, but specific sandboxing, container isolation, and network security controls for this agent's runtime are not detailed.

Not certain from the listing — While a seamless handoff to human agents is mentioned as a fallback, the specific evaluation, logging, and real-time guardrail mechanisms used to monitor the agent's autonomous decisions are not detailed.

Not certain from the listing — Although Salesforce platforms generally adhere to strict compliance standards (SOC2, GDPR, etc.), the specific identity, authorization, and audit policies governing this autonomous agent's actions are not explicitly stated.

Not certain from the listing — The agent interacts with human agents for handoffs, but its broader multi-agent coordination capabilities or vulnerabilities to cascading failures within a larger agent ecosystem are not defined.