Agentforce 360 is Salesforce’s unified agentic AI platform, reaching general availability on October 13, 2025, with 12,000 customers, including Reddit and OpenTable, running it in production. It competes with ServiceNow, Microsoft Copilot Studio, AWS Bedrock, Gemini Enterprise, and Sierra as a vendor-native agent platform, tightly coupled to its own data estate. Atlan sits alongside those platforms from a different angle: the shared context plane, definitions, lineage, and policy, that Agentforce (and its peers) can reach for when an answer depends on data or meaning living beyond any single CRM.
Agentforce 360 folds what used to be separately branded components, the Atlas Reasoning Engine, Data Cloud, and early MCP support, into one platform under Salesforce’s “Agentic Enterprise” push. The addition that matters most for this page is Intelligent Context, which exists because raw CRM records were never enough context for an agent to act on reliably. Alongside it, Salesforce’s hosted MCP servers reached GA in April 2026. Atlan connects to that same MCP-native ecosystem through its own MCP server, carrying the lineage, ownership, and business-term definitions that sit outside Data 360’s reach.
- Atlas Reasoning Engine: the planning and self-correction core behind every agent action
- Data 360: the unified data layer (renamed from Data Cloud) grounding agents in CRM records
- Hosted MCP servers: GA since April 2026, with prebuilt servers for the Agentforce 360 Platform, Tableau Next, and Data 360 SQL
- Enterprise MCP Registry: announced, and still described entirely in future tense on Salesforce’s MCP support page
- Data 360 MCP Server: a developer-preview server (May 2026), open-source and run locally against a single org
- Enterprise Data Graph: Atlan’s lineage, ownership, and certification layer for everything Data 360 doesn’t natively ingest
| Agentforce 360: Quick Facts | |
|---|---|
| What it is | Salesforce’s unified agentic AI platform, bundling reasoning, data, apps, and Slack |
| Key benefit | Agents that plan, act, and self-correct across CRM and connected business workflows |
| GA date | October 13, 2025 |
| Customers | 12,000 at GA, including Reddit, OpenTable, Adecco, Engine, and 1-800Accountant |
| GA pillars | Agentforce 360 Platform, Data 360, Customer 360 Apps, Slack |
| Pricing model | Flex Credits (consumption-based); ~$0.10 per standard action |
What is Agentforce 360?
Agentforce 360 is Salesforce’s unified agentic AI platform, announced at Dreamforce 2025 and generally available October 13, 2025, bundling the Agentforce 360 Platform, Data 360, Customer 360 Apps, and Slack into a single “Agentic Enterprise” offering. Salesforce’s own general-availability announcement frames it as “the world’s first platform to connect humans and AI agents in one trusted system”, a claim built on the same AI agent architecture pattern every enterprise vendor platform in this category now follows: a reasoning core, a data layer, an application layer, and a connector layer for reaching outside tools.
At GA, Salesforce reported 12,000 customers running Agentforce 360, naming Reddit, OpenTable, Adecco, Engine, and 1-800Accountant, a scale that puts it ahead of most competing enterprise copilot launches. Srini Tallapragada, President and Chief Engineering Officer at Salesforce, described the ambition behind the bundling directly in comments to Constellation Research: “Agentforce 360 is a deeply unified platform. We don’t want customers stuck in what I call the pilot bucket.” That framing matters for how enterprises use AI agents broadly, since a platform built to avoid the “pilot bucket” is implicitly admitting how many agent projects never leave it, the exact failure mode covered later on this page.
Agentforce 360 sits in the same competitive lane as Gemini Enterprise from Google, AWS Bedrock for enterprise agents from Amazon, and the frameworks compared in AWS Bedrock Agents vs. LangGraph: a cloud vendor’s own agent platform, built to be the default place its existing customers build agents. Each platform in that lane, Salesforce included, is strong within its own boundary and faces the same governed-context question once an agent needs data the platform was never built to hold.
Agentforce 360 vs. Agentforce 1.0, 2.0, and 3.0: what changed
Agentforce 360 is the fourth major iteration of Salesforce’s agent platform, and the name change reflects a real scope expansion, not just a rebrand. Salesforce Ben’s Dreamforce coverage catalogs what’s genuinely new in this release, Voice and Agent Script among them, versus what’s carried over with a new name, Data Cloud becoming Data 360.
| Version | Announced/GA | Key change | Notable addition |
|---|---|---|---|
| Agentforce 1.0 | September 2024 (Dreamforce) | Initial launch; “digital labor” framing | First agent-building tools in Salesforce |
| Agentforce 2.0 | December 2024 | Atlas Reasoning Engine | Self-correcting, multi-step planning |
| Agentforce 3 | June 2025 | Command Center observability | Built-in MCP support (native client at pilot); 100+ industry actions |
| Agentforce 360 | October 13, 2025 (GA) | “Agentic Enterprise” platform | Intelligent Context; Voice; Slack as a named pillar |
The rename cadence has a real cost, though. Salesforce Ben’s own analysis of the pattern quotes an unnamed admin on r/Salesforce reacting to yet another name change: “Is it a thing or not? Does it require a 6-month implementation…license and feature toggle?” That confusion is worth separating from the context question this page builds toward: a confusing product name is an adoption-friction problem, not evidence that Agentforce 360’s underlying context reach is insufficient. Both show up in the same practitioner-skepticism cluster, but they are not the same failure mode.
How does Agentforce 360 work?
Agentforce 360’s architecture layers a reasoning engine, a unified data layer, and an open connector registry so agents can act across Salesforce workflows and, increasingly, external systems. Each layer below handles a distinct part of how an agent decides what to do and what it’s allowed to see while doing it.
Atlas Reasoning Engine
The Atlas Reasoning Engine is Agentforce 360’s planning core. It runs cooperative agent reasoning that plans a sequence of steps, checks its own output against the goal, and revises the plan when a step fails, the self-correcting loop that separates a genuine AI agent from a single-shot chatbot response. Atlas is documented as the reasoning layer underneath every Agentforce action, regardless of which app or channel the agent runs in.
Data 360 and the Data 360 MCP Server
Data 360, Salesforce’s rename of Data Cloud, is the unified data layer that grounds agents in CRM and connected records, including zero copy federation into Snowflake, BigQuery, Redshift, and Databricks. Two separate MCP efforts sit on top of it, and they are at different maturity levels. Salesforce’s hosted MCP servers went GA in April 2026 for every Enterprise Edition org and above, with prebuilt standard servers for the Agentforce 360 Platform, Tableau Next, and Data 360 SQL. Existing CRUD, field-level security, and sharing rules apply automatically, every transaction runs as the authenticated user, and a server has to be explicitly enabled before an assistant can reach it. Separately, in May 2026, Salesforce shipped a Data 360 MCP Server in developer preview, open-source on GitHub. That one runs locally over stdio, is explicitly not yet multitenant (each instance connects a single user to a single org), needs Java 17+ and Maven, and exposes roughly 200 Data 360 platform-administration operations behind three facade tools. Salesforce says it will become a hosted server at GA.
Enterprise MCP Registry
Salesforce describes an Enterprise MCP Registry as the open-connector layer that would let Agentforce agents call external Model Context Protocol servers as tools. Worth reading the tense carefully: Salesforce’s MCP support page describes the centralized registry entirely in the future, with no GA, beta, or pilot label attached, and no Salesforce page confirms it shipped with the October 2025 GA. Treat it as announced direction. The capability that has actually shipped is the hosted MCP servers above, plus Agentforce acting as the native Salesforce MCP client, which is the same open-door pattern Atlan uses to serve its own context to Agentforce and any other MCP-compliant agent platform.
Customer 360 Apps and Agent Builder, Script, and Voice
Customer 360 Apps is where agents actually act, inside Sales, Service, and Slack workflows, backed by three ways to build and extend them:
- Agent Builder: a no-code way for admins to define what an agent can do
- Agent Script: a code-first authoring option for more complex logic
- Voice: extends agents into phone and contact-center channels
The April 2026 hosted MCP GA is Salesforce opening its own context up to external MCP clients at production scale, the same pattern Atlan uses to feed Agentforce data it doesn’t natively hold. That symmetry is the clearest evidence in this section: a platform that owns the CRM system of record still found it necessary to build an open door for context it doesn’t produce itself, which is exactly the gap a context layer exists to fill one level up, across every system an agent touches, not just Salesforce’s own.
Data 360 already federates Snowflake, BigQuery, Redshift, and Databricks natively. What it doesn't resolve on its own, business-term definitions and cross-system lineage, is where an external MCP server picks up.
Get the CIO's guide to context graphs
See the four-layer architecture data leaders are using to give agents like Agentforce context beyond their native connectors, from metadata foundation to agent orchestration.
Get the CIO GuideAgentforce 360 pricing: Flex Credits explained
Agentforce 360 runs on a consumption-based Flex Credits model rather than flat per-seat licensing. A standard agent action costs 20 credits, roughly $0.10, and Salesforce sells credit blocks at $500 per 100,000 credits; a voice action costs more, at 30 credits, roughly $0.15, reflecting the added compute of real-time speech. Salesforce meters every standard action once, irrespective of how many tokens it processes, and doesn’t bill utilities like escalations or topic transitions as agent actions. Salesforce Foundations includes 450,000 Flex Credits shared across Agentforce and Data 360, with restrictions and regional variation, enough to prototype and pilot a first agent before committing further budget. That figure has moved twice since May 2025 and the Foundations page itself carries more than one number, so check it rather than quoting this one.
For teams evaluating whether Agentforce 360’s Foundations free tier covers their pilot, Salesforce’s own getting-started documentation walks through provisioning a first agent; this page stays at the pricing-mechanics level rather than a step-by-step setup, since that’s a separate job. Because Flex Credits meter every individual action, teams scaling past a pilot should model consumption the same way they’d model the cost to run AI agents at scale on any platform, since action volume, not seat count, drives the bill.
| Pricing model | Unit | Cost | Best for |
|---|---|---|---|
| Flex Credits (standard action) | Per action (20 credits) | ~$0.10/action | High-volume, variable-length interactions |
| Flex Credits (voice action) | Per voice action (30 credits) | ~$0.15/action | Voice and contact-center use cases |
| Credit blocks | Per 100,000 credits | $500 | Budgeting at scale |
| Free allotment | Per org (Salesforce Foundations) | 450,000 Flex Credits, shared with Data 360; restrictions apply | Piloting a first agent |
Agentforce 360 use cases: where teams see ROI
The clearest published results for Agentforce 360 come from customer service deflection, though Salesforce also positions it for sales and internal helpdesk workflows.
Customer service case deflection
Reddit deflected 46% of support cases and cut resolution times by 84%, dropping average response time from 8.9 minutes to 1.4 minutes using Agentforce, the single most concrete customer proof point Salesforce has published for Agentforce 360. That kind of deflection is the same outcome enterprise-ready AI agents are built to produce once they’re trusted with real customer interactions, not just demo scripts.
Sales lead qualification
AI agents for sales use Agentforce to triage and qualify inbound leads before a human rep engages, freeing reps to spend time on deals an agent has already vetted.
Internal HR/IT helpdesk via Slack
Agentforce agents surfaced through Slack handle internal HR and IT helpdesk questions, the same pattern many teams use when they give AI agents access to enterprise data for employee-facing, not just customer-facing, workflows.
Why do Agentforce implementations stall?
Practitioner coverage of Agentforce 360 consistently blames data quality and governance for stalled rollouts, not the underlying reasoning engine.
The ForcedLeak vulnerability is a concrete, current proof point that the stakes go beyond accuracy. The flaw, CVSS 9.4, let attackers exfiltrate CRM data from Agentforce through prompt injection via Web-to-Lead forms, using a whitelisted domain that cost $5 to register, disclosed by Noma Security in September 2025 and covered widely by The Hacker News and The Register. Sasi Levi, Security Research Lead at Noma Security, framed the stakes plainly: “This vulnerability demonstrates how AI agents present a fundamentally different and expanded attack surface compared to traditional prompt-response systems.” Salesforce patched the flaw within days of disclosure, but a vulnerability that turned an ungoverned intake form into a CRM-data exfiltration path is a governance failure with security consequences, not a narrow bug, the exact territory covered by AI agent risks and guardrails and by securing multi-agent systems in the enterprise.
The pattern isn’t limited to one disclosed vulnerability. Gartner predicts more than 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls. Anushree Verma, Senior Director Analyst at Gartner, put it directly: “Most agentic AI projects right now are early stage experiments or proof of concepts that are mostly driven by hype and are often misapplied.” That statistic isn’t specific to Agentforce, but it names the exact failure mode independent sources report once an agent meets real CRM data instead of a clean demo.
The synthesis this page owns: Salesforce’s own Intelligent Context and hosted MCP build-out is at minimum an acknowledgment that CRM-native context wasn’t sufficient on its own, even if Salesforce would frame the same build-out as ecosystem openness rather than an admitted gap. Sweep.io’s framing of the release captures the practitioner read: Agentforce 360 can only be as smart as the metadata that fuels it. That’s the same failure mode context-layer vendors exist to solve, recurring one layer up, across systems, not just across CRM records. The renaming-fatigue criticism covered earlier is a real, adjacent signal of buyer friction, but it’s a different problem from insufficient context, and conflating the two obscures what’s actually driving the 40% cancellation number: AI agent accuracy depends on context and governance, not on which version name Salesforce ships next, a conclusion that also shapes how teams scale AI agents from POC to production and prepare enterprise data for AI agents on any platform, not just this one.
Check your context readiness before you scale
Most Agentforce rollouts stall on data readiness, not the reasoning engine. Run through the checklist enterprises use to spot gaps before scaling past a pilot.
See Your Readiness ScoreHow do you choose the right context strategy for Agentforce 360?
Choosing a context strategy for Agentforce 360 means evaluating how well data quality, governance, and cross-system reach are covered before rollout, not just which reasoning engine to trust.
Every platform in Agentforce 360’s competitive set, ServiceNow, Microsoft Copilot Studio, AWS Bedrock, Gemini Enterprise, and Sierra, faces the identical question once an agent needs data the vendor’s own platform was never built to hold. Holger Mueller, VP and Principal Analyst at Constellation Research, frames Salesforce’s position in that field this way: “While competitors work on single products and second versions, Salesforce has a suite of AI offerings available with its typical 360 brand. This represents another data point on how Salesforce has a lead of one or two years over key competitors.” A platform lead in bundling doesn’t remove the context question; it just means every vendor in the category has to answer it eventually.
Before committing to a context strategy, ask whether it reaches data Data 360 doesn’t hold, who resolves what “revenue” or “churn” means before an agent acts on it, and what happens when an agent needs a system Agentforce doesn’t natively connect to. Getting these answers right is what separates agents that work reliably at scale from the ones that join the 40% Gartner expects to stall.
| Criterion | Why it matters | What to look for |
|---|---|---|
| Data quality & governance | Agents act on records at face value; bad data propagates errors immediately | Automated certification and access control before an agent can query a record |
| Cross-system reach beyond CRM | Data 360 covers Salesforce-native and zero copy federated sources, not every SaaS tool | A context source that reaches data across the estate, not just Data 360 |
| Security & prompt-injection controls | ForcedLeak showed intake forms can become exfiltration paths | Policy enforcement checked at the point the agent acts, not just at ingestion |
| MCP-native connectivity | New tools and agent platforms should plug in without a rebuild | An open, MCP-compatible context source alongside Salesforce’s hosted MCP servers |
| Semantic consistency of definitions | Different teams calculate the same metric differently | A certified semantic layer resolving one definition per term |
How Atlan approaches context for Agentforce 360
Agentforce 360’s own context reach still stops at Salesforce’s boundary, Data 360, Customer 360 Apps, and whatever zero copy or MCP connections an admin wires up. CRM-native AI breaks when the answer depends on data or meaning that lives beyond one vendor’s boundary; the hardest enterprise questions cross warehouse, CRM, and ERP lines, not just CRM records, the same gap covered in making AI agents context-aware.
Salesforce owns the agent runtime and CRM workflows; Atlan’s position is the shared context plane, definitions, lineage, quality, ownership, and policy, served to agents, including Agentforce, via MCP, SQL, and APIs. Atlan’s own MCP server acts as an external context source Agentforce agents can call for data Data 360 doesn’t hold. The Enterprise Data Graph carries lineage, ownership, and certification across every connector in the stack, not just Salesforce-native ones. Active Ontology resolves what a business term means, revenue, churn, active account, before an agent acts on a number pulled from Data 360 or a connected warehouse, the same context graph discipline that separates a resolved definition from a generic knowledge graph lookup.
Atlan and Salesforce both back the Open Semantic Interchange standard, a real, verifiable point of technical alignment, not a marketing claim. This page doesn’t attach a specific customer metric to an Agentforce deployment, since none is publicly citable yet; the architecture claim itself, Atlan’s MCP server extending Agentforce’s reach, is consistent with how Atlan already connects to the wider Salesforce ecosystem, covered in more depth on the What Is Salesforce Agentforce? page.
Real stories from real customers: MCP-native context in production
The MCP-native pattern this page describes for Agentforce 360 isn’t specific to Salesforce. Atlan’s own MCP server and Enterprise Data Graph already run in production at enterprises solving the same shared-vocabulary and context-operating-system problem outside any single CRM.
"We're excited to build the future of AI governance with Atlan. All of the work that we did to get to a shared language at Workday can be leveraged by AI via Atlan's MCP server…as part of Atlan's AI Labs, we're co-building the semantic layer that AI needs with new constructs, like context products."
— Joe DosSantos, VP of Enterprise Data & Analytics, Workday
"Atlan is much more than a catalog of catalogs. It's more of a context operating system…Atlan enabled us to easily activate metadata for everything from discovery in the marketplace to AI governance to data quality to an MCP server delivering context to AI models."
— Sridher Arumugham, Chief Data & Analytics Officer, DigiKey
See context agents live
Watch how a governed context layer connects Data 360, warehouses, and everything outside them to AI agents in real time, across systems and vendors.
Watch a Live DemoWhy Agentforce 360 is evidence for the context layer, not against it
Agentforce 360 is a real architectural leap for Salesforce, not a rebrand dressed up as one. Reddit’s 46% deflection rate is a genuine production result, Salesforce publishes several stronger ones (CVS Health at 58% chat containment, Live Nation at 95% case deflection, Xero resolving 62% of support cases autonomously across more than 800,000 a year), and the April 2026 hosted MCP GA is a genuine commitment to MCP-native connectivity. None of that is in dispute.
What’s worth noticing is what Salesforce built alongside those wins: Intelligent Context and a GA fleet of hosted MCP servers both extend Agentforce 360’s reach because the reasoning engine alone, however capable, was never going to be enough on its own. Salesforce would likely frame both as ecosystem openness rather than a gap; either read still lands on the same fact: a platform that owns the CRM system of record still had to build a door for context it doesn’t produce itself. That’s not a knock on Agentforce 360. It’s evidence that the context problem isn’t a Salesforce-specific gap; it’s the same gap ServiceNow, Microsoft Copilot Studio, AWS Bedrock, Gemini Enterprise, and Sierra all face, one level up from any single vendor’s estate, and it’s why why AI agents need an enterprise context layer covers this exact pattern across the category, not just this one platform.
FAQs about Agentforce 360
1. What is Agentforce 360 in Salesforce?
Agentforce 360 is Salesforce’s unified agentic AI platform, generally available since October 13, 2025. The GA release names four pillars: the Agentforce 360 Platform, the Data 360 unified data layer, Customer 360 Apps, and Slack, under Salesforce’s “Agentic Enterprise” positioning, replacing what was previously a set of separately named Agentforce components.
2. What’s the difference between Agentforce 3.0 and Agentforce 360?
Agentforce 3, released in June 2025, added the Command Center for observability, built-in MCP support with the native MCP client at pilot, and 100+ prebuilt industry actions. Agentforce 360, which reached general availability four months later, packaged that work into a broader unified platform and added Intelligent Context and Voice.
3. What are Flex Credits in Agentforce 360?
Flex Credits are Agentforce 360’s consumption-based pricing unit. A standard agent action costs 20 credits, roughly $0.10, and a voice action costs 30 credits, roughly $0.15. Every standard action is metered once no matter how many tokens it processes. Salesforce sells credit blocks at $500 per 100,000 credits, and Salesforce Foundations includes 450,000 Flex Credits shared across Agentforce and Data 360, with restrictions. That allotment has moved twice since the May 2025 launch, so check the Foundations page before budgeting.
4. Is Agentforce 360 included in my Salesforce license?
No, Agentforce 360 is a separate, consumption-based purchase billed through Flex Credits. Salesforce’s Foundations tier includes a free credit allotment so teams can pilot a first agent, but scaling past a pilot requires budgeting for Flex Credits separately from existing Salesforce license costs.
5. What is the Atlas Reasoning Engine?
The Atlas Reasoning Engine is the planning core behind every Agentforce 360 action. It runs cooperative agent reasoning that plans a sequence of steps, checks its own output against the goal, and revises the plan when a step fails, rather than answering once and stopping like a single-shot chatbot.
6. Why do Agentforce implementations fail or stall?
Practitioner coverage consistently blames CRM data quality and governance readiness, not the Atlas Reasoning Engine. Gartner projects over 40% of agentic AI projects will be canceled by 2027 over escalating costs and unclear business value, the same pattern independent sources report specifically for Agentforce rollouts.
7. Is Agentforce 360 secure?
According to Noma Security, which disclosed it, a CVSS 9.4 prompt-injection flaw called ForcedLeak let attackers exfiltrate CRM data through a $5 expired whitelisted domain reached via Web-to-Lead forms, and Salesforce patched it in September 2025. Noma’s account is corroborated by The Hacker News and The Register; no Salesforce security advisory confirming it could be found. The disclosure shows agent context and governance failures carry security consequences, not just accuracy ones.
8. Does Agentforce 360 work with data outside Salesforce, like warehouses or BI tools?
Partially. Data 360’s zero copy federation reaches Snowflake, BigQuery, Redshift, and Databricks natively, plus S3, GCS, and ADLS through File Federation, and Salesforce’s hosted MCP servers went GA in April 2026 with a prebuilt Data 360 SQL server. Business-term definitions, cross-system lineage, and most other SaaS tools in a typical stack still sit outside what Data 360 natively resolves on its own.
9. How does Atlan connect to Agentforce 360?
Atlan connects through its own MCP server, which Agentforce agents can call as an external context source for data Data 360 doesn’t hold. Atlan and Salesforce also both back the Open Semantic Interchange standard, giving the two platforms a shared, open way to align on what business terms mean.
Sources
- Welcome to the Agentic Enterprise: With Agentforce 360, Salesforce Elevates Human Potential in the Age of AI, Salesforce (2025). https://www.salesforce.com/news/press-releases/2025/10/13/agentic-enterprise-announcement/
- Agentforce 360 Announcements / What’s New, Salesforce (2026). https://www.salesforce.com/agentforce/what-is-new/
- Salesforce Unveils ‘Agentforce 360’ at Dreamforce '25, Salesforce Ben (2025). https://www.salesforceben.com/salesforce-unveils-agentforce-360-at-dreamforce-with-new-features-including-voice/
- Why Salesforce’s Renaming Reputation Is a Problem in the Agentforce Era, Salesforce Ben (2026). https://www.salesforceben.com/why-salesforces-renaming-reputation-is-a-problem-in-the-agentforce-era/
- How the Atlas Reasoning Engine Powers Agentforce, Salesforce (2025). https://www.salesforce.com/agentforce/what-is-a-reasoning-engine/atlas/
- Introducing the Data 360 MCP Server (Developer Preview), Salesforce Developers Blog (2026). https://developer.salesforce.com/blogs/2026/05/introducing-the-data-360-mcp-server-developer-preview
- forcedotcom/d360-mcp-server, GitHub (2026). https://github.com/forcedotcom/d360-mcp-server
- Agentforce MCP Support / Enterprise MCP Registry, Salesforce (2026). https://www.salesforce.com/agentforce/mcp-support/
- Salesforce Agentforce Pricing, Salesforce (2026). https://www.salesforce.com/agentforce/pricing/
- Salesforce Hosted MCP Servers Are Now Generally Available, Salesforce Developers Blog (2026). https://developer.salesforce.com/blogs/2026/04/salesforce-hosted-mcp-servers-are-now-generally-available
- Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027, Gartner (2025). https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027
- ForcedLeak: AI Agent Risks Exposed in Salesforce Agentforce, Noma Security (2025). https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce/
- Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection, The Hacker News (2025). https://thehackernews.com/2025/09/salesforce-patches-critical-forcedleak.html
- Prompt injection, and a $5 domain, trick Salesforce Agentforce into leaking sales, The Register (2025). https://www.theregister.com/2025/09/26/salesforce_agentforce_forceleak_attack/
- Agentforce 360: Salesforce’s Big Scale-Up of the Agentic Enterprise, Sweep (2025). https://www.sweep.io/blog/a-360-degree-guide-to-agentforce-360
- Salesforce makes its Agentforce 360 case to be your AI agent platform, Constellation Research (Holger Mueller, 2025). https://www.constellationr.com/insights/news/salesforce-makes-its-agentforce-360-case-be-your-ai-agent-platform
- Salesforce Foundations (official product page; verify the current free-tier Flex Credit allotment here before citing a number). https://www.salesforce.com/crm/foundations/
- Agentforce Metrics (customer outcomes and adoption figures), Salesforce (2026). https://www.salesforce.com/agentforce/metrics/
