Salesforce security leaders warn that agentic AI could speed up cyberattacks and defenses at the same time

Cybersecurity threats are taking on a new pace and a new risk profile as “agentic” artificial intelligence systems move from assisting humans to running parts of an attack or defense on their own. Salesforce is using a recent example from the security industry to make the point: a ransomware campaign labeled “Jade Puffer,” where an initial human kick-started the operation but an autonomous AI agent carried out the technical steps of the intrusion, including reconnaissance and the encryption and deletion of databases.

Salesforce argues that when the time scale collapses to milliseconds, the usual model of waiting for alerts and then relying on human triage becomes untenable. In that environment, the company’s executives say the practical question is no longer whether to “fight AI with AI,” but how to design defensive agents that do not go rogue. Salesforce compares the dynamic to the “Spy vs. Spy” concept, where both sides act quickly and unpredictably.

Muhammad Fraser-Rahim, Salesforce’s VP of Global Intelligence and Product/Platform Risk, framed the moment as a coming reality rather than a distant concern. While he acknowledged the cinematic feel of autonomous cyber operations, he emphasized that organizations need to ensure they can trust AI systems when those systems are capable of taking technical actions.

The speed advantage is a double-edged sword. Greg Notch, CTO at cybersecurity firm Expel, said agentic AI provides lower-skilled attackers with tools that can look more sophisticated than before, while also letting defenders sift through large numbers of potential-attack indicates to focus on the ones that warrant intervention. Notch added that even when defenders automate parts of an investigation, they typically want humans to review AI work enough to ensure outcomes are correct, with examples including automating actions like resetting identity verification on a compromised laptop.

Salesforce security leadership said the operational challenge is preventing both under-reaction and over-reaction. One risk is that defensive automation responds too aggressively when something looks dangerous but is not. Salesforce cited the example of an autonomous system shutting down an entire hospital data network in response to the compromise of a single, noncritical application, underscoring how quickly collateral damage could occur.

In terms of industry concern, Salesforce referenced survey and research findings that highlight how broadly the category is being treated as dangerous. The company pointed to a Dark Reading readership poll in which 48% of security professionals identified agentic AI and autonomous systems as the most dangerous attack vector, and to an Anthropic report that found “high risk” AI-enabled threats rose to 56% of total cyber incidents, up from 33% a year earlier.

Salesforce’s executives also focused on a core asymmetry: threat actors may only need to succeed once, while defenders must be correct every time. Kelly McCracken, Deputy Chief Information Security Officer and SVP of Security Operations at Salesforce, said “We have to be right every time,” contrasting that with the attacker’s ability to be right only one time. In that context, Salesforce described speed as the hinge factor. Iain Mulholland, Chief Information Security Officer at Salesforce, said the hardest part historically has been fixing vulnerabilities rapidly, reliably, and at scale, and he called the acceleration of remediation enabled by agentic AI models “game-changing.”

To address the speed and accuracy demands, Salesforce says it is designing guardrails that keep humans in the loop for consequential actions. Doug Miller, Salesforce VP of Integrated Threat Management, likened onboarding and trust-building for agents to how people learn to work with a new employee, with the difference that agents do not “sleep.” Salesforce’s security leaders said the practical control is a human approval point for anything that could cause an availability outage. McCracken described it directly: “The button to cause any type of availability outage should be pushed by a human.”

Beyond the cyber layer, Salesforce raised concerns about how AI misjudgments could spill into the physical world, such as building access systems that depend on badges and elevator permissions. Fraser-Rahim described a scenario where an AI agent could incorrectly decide who should have access, potentially locking out authorized staff or allowing someone unauthorized to enter. The company’s message is that enterprises need oversight and alignment across systems that connect cyber authorization to physical infrastructure.

Salesforce also linked these ideas to its broader “Customer Zero” posture, describing it as a set of internal safeguards that mirror what customers can do, what customers can configure, and what can be enhanced through add-ons. The company said this approach helps it test actions and defenses using the same technology it provides externally. Salesforce then described a purpose-built vulnerability agent that continuously triages exposure by scanning to determine whether the company is impacted by specific vulnerabilities, and it also triages and recommends fixes, which it says is how it can compress patch timelines from “seven-plus days” to under an hour. Salesforce added that for Agentforce, governance starts with a Trust Layer that customers can shape by setting which prompts are allowed or blocked, and that controls can identify malicious activity at both the prompt and execution stages.

What Salesforce did not disclose in detail is exactly how much of its defensive workflow is automated end-to-end, what specific thresholds trigger human intervention, or any formal performance metrics such as false-positive rates or time saved across different vulnerability classes. The company also did not publish technical documentation spelling out how agents are sandboxed or how model-specific failures are handled beyond emphasizing human oversight, continuous monitoring, audit trails, and access controls such as least-privilege and strict isolation.

Looking ahead, Salesforce’s executives suggested that organizations should expand the governance conversation beyond security teams to boards and corporate leadership, with questions about funding data compliance and technical controls and about whether monitoring data access is sufficient to understand what people and systems are doing with company data. The immediate watch items, based on Salesforce’s framing, are how enterprises operationalize human approval for high-impact actions, how they manage agent identities and reversibility, and whether vendors can reduce dependencies on any single AI model as the underlying model ecosystem becomes more volatile.