In the wild
Realized harm
Stolen OAuth tokens from the Drift AI chat agent used to exfiltrate Salesforce data from 700+ organizations
AIR-2025-0118 AIR record · 2025-08-salesloft-drift-oauth-salesforce-theft
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
In August 2025, Salesloft experienced a supply chain breach through its Drift chatbot integration that impacted more than 700 organizations.thehackernews.com
The record
Disclosed
2025-08-26
Occurred
2025-08-08
Vendor
Salesloft
Product
Salesloft Drift (AI chat agent) integrated with Salesforce, Google Workspace and Slack
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Data exfiltration channels
System type
Generative model
Who acted
AI was the target (contested) — OAuth tokens stolen from the AI chat integration were replayed by humans
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Compromised oauth refresh tokens of an ai chat agent integration
Impact type
Data exfiltration, Credential theft, Supply chain compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
more than 700 organizations; Salesforce Cases, Accounts, Users and Opportunities; AWS keys, Snowflake tokens and passwords found in support text
Capability abused
Defense & remediation
Recorded defense
OAuth scoping and app allowlisting
Guardrail kinds
Permission scope, Authentication
Guardrail outcome
Silent
Fix shipped
Salesloft revoked Drift-Salesforce connections, removed Drift from AppExchange and took Drift offline; customers told to re-authenticate and rotate credentials
Taxonomy & references
Curator notes
Attributed to UNC6395 by Google Threat Intelligence. Included mainly for the regulatory follow-on: FINRA issued a cybersecurity alert to member firms naming the Drift AI agent, directing forensic review of Salesforce, Google Workspace and Slack logs for 2025-08-08 to 2025-08-18 and reporting to FINRA, the SEC and the FBI. That regulator response is the press/regulatory-unique part; the breach itself will overlap with the security-research records. The Google Cloud threat-intel writeup is the preferred technical primary source but is not used as the source here.
Supporting sources
Cite as
Enkrypt AI. "Stolen OAuth tokens from the Drift AI chat agent used to exfiltrate Salesforce data from 700+ organizations". AIR, AIR-2025-0118. https://agentincident.vercel.app/i/AIR-2025-0118/ (accessed 2026-10-19).