Salesforce Sites Face Emerging Threat from Autonomous AI Hackers

Artificial intelligence is fundamentally reshaping the cybersecurity threat landscape. As more threat groups integrate large language models into their attack workflows, the traditional assumption that complex vulnerabilities are too difficult to exploit is rapidly becoming obsolete. AI-powered agents can now find, analyse, and exploit vulnerabilities fully autonomously — with no human guidance required.

From Concept to Autonomous Attack

Security research firm Reco built an AI-powered agent capable of performing end-to-end security assessments of Salesforce Experience Cloud sites — completely autonomously. Provide it with a single URL, and the agent independently discovers the attack surface, analyses exposed endpoints, identifies vulnerabilities, writes working exploits, and executes them. When tested against real-world Salesforce sites belonging to major technology companies, the results were deeply sobering — high-severity vulnerabilities were discovered even in organisations with significant security investments.

A Five-Phase Attack Pipeline

The agent operates through five distinct phases mirroring how a human security researcher would work. In Phase 1, it maps the entire attack surface by querying the Salesforce Aura framework to enumerate accessible objects, controller methods, routes, and content. Phase 2 shifts to data analysis — categorising discovered objects by sensitivity and probing for exposed records as a guest user. Phase 3 deploys Apex fuzzing — inferring valid input values, invoking exposed methods, and systematically probing for SOQL injection vulnerabilities by comparing baseline responses against injected payloads.

When an exploitable vulnerability is confirmed, Phase 4 generates standalone Python exploit scripts from scratch — implementing full exploitation chains including character-by-character data extraction and pivot queries targeting high-value objects like User, Contact, and Lead tables. Finally, Phase 5 performs an adversarial self-review — evaluating whether findings reflect genuine demonstrated impact rather than theoretical severity.

A Wake-Up Call for Enterprise Security

Reco operated under strict ethical constraints — no bulk extraction, no write or delete operations. Yet the agent still successfully extracted real PII from production environments. The uncomfortable conclusion is clear: what a responsible researcher can do today, a malicious actor can do tomorrow.

As AI capabilities accelerate, organisations running Salesforce Experience Cloud — and broader enterprise SaaS platforms — must urgently reassess their guest access configurations, API exposure, and proactive vulnerability management strategies before autonomous attackers do it for them.