In the wild
Realized harm
UNC6395 mass-exfiltrated Salesforce data using OAuth tokens stolen from the Salesloft Drift AI chat agent
AIR-2025-0119 AIR record · 2025-08-salesloft-drift-unc6395
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application.cloud.google.com
The record
Disclosed
2025-08-26
Occurred
2025-08-08
Vendor
Salesloft / Salesforce
Product
Salesloft Drift integration with Salesforce
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Data exfiltration channels
System type
Generative model
Who acted
AI was the target (contested) — the AI agent product was the compromised entry point; humans queried Salesforce
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Compromised oauth tokens of third party ai agent integration
Impact type
Data exfiltration, Credential theft, Downstream compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Hundreds of corporate Salesforce instances; secondary credentials (AWS AKIA keys, Snowflake tokens, passwords) harvested from case and ticket text
Capability abused
Defense & remediation
Recorded defense
OAuth scoping
Guardrail kinds
Authentication
Guardrail outcome
Silent
Fix shipped
Salesforce revoked all Drift OAuth tokens and removed Drift from AppExchange; Salesloft engaged Mandiant (Aug-Sept 2025)
Taxonomy & references
Curator notes
The largest real breach to date in which an AI agent product was the entry point. Caveat on framing: the agent's language capability was not attacked - what was abused was the sweeping OAuth authority the chat agent held over customer CRMs, and the initial compromise was of Salesloft's GitHub/Drift infrastructure. Palo Alto Networks, Zscaler, Cloudflare, Proofpoint and others publicly confirmed exposure; Google/Mandiant did not publish a victim count.
Supporting sources
Cite as
Enkrypt AI. "UNC6395 mass-exfiltrated Salesforce data using OAuth tokens stolen from the Salesloft Drift AI chat agent". AIR, AIR-2025-0119. https://agentincident.vercel.app/i/AIR-2025-0119/ (accessed 2026-10-19).