SERVANTSTACK // INCIDENT INTELLIGENCEFORENSIC IMAGE // VERIFIED FRAME

SS-IR-061 // INCIDENT REPORTReported

Salesloft

Stolen Drift AI Chatbot OAuth Tokens Drained Salesforce Data From 700+ Organizations

EXECUTIVE BRIEF

AGENTIC AI DATA & CYBER SECURITY

FAILURE CHAINTRACE COMPLETE

01TRIGGERBetween August 8 and August 18, 2025, a threat group tracked as UNC6395 stole OAuth and refresh tokens tied to Drift,…
02MACHINE ACTIONAutonomous actor
03MISSING GATETrust boundaries, least privilege, and output approval
04IMPACTData security

01 // INCIDENT SUMMARY

The short version

02 // KEY FACTS

Case telemetry

INCIDENT: SS-IR-061
DATE: August 2025
SYSTEM: Salesloft
LOCATION / SCOPE: Global
EVIDENCE: Reported
AI ROLE: Autonomous actor
HARM: Data security
SOURCES: 2 cited records

03ENTRY POINT // WHAT HAPPENED

The event

Between August 8 and August 18, 2025, a threat group tracked as UNC6395 stole OAuth and refresh tokens tied to Drift, the AI chatbot made by Salesloft and embedded in thousands of companies' sales and support workflows. Using those tokens, the attackers systematically queried and bulk-exported records from the Salesforce instances of more than 700 organizations, including Cloudflare, Palo Alto Networks, Zscaler, Proofpoint, PagerDuty, and Tanium. The exfiltrated data was principally Salesforce support case text, contacts, and account records, which the attackers then mined for embedded secrets such as AWS access keys, VPN credentials, and Snowflake credentials. Investigators (Google Threat Intelligence Group and Palo Alto Unit 42) found the stolen Drift tokens also reached other connected platforms, including Slack, Google Workspace, Amazon S3, Microsoft Azure, and OpenAI. The breach was discovered on August 20, 2025, when Salesloft and Salesforce revoked all Drift OAuth tokens and pulled the Drift app from the Salesforce AppExchange.

04CAUSAL TRACE // AI'S ACTUAL ROLE

What the machine did

Drift is an agentic AI integration: it holds long-lived OAuth tokens so the chatbot can read and act on customer data across Salesforce, Slack, Google Workspace, and other systems on the customer's behalf, without a human in the loop for each access. That standing, broadly-scoped machine authorization was exactly what the attackers harvested and replayed. Because the tokens were legitimate AI-integration credentials, the bulk record counting, object mapping, and mass export looked like normal automated chatbot traffic and tripped few alarms. There was no human approval gate on the AI integration's data access, no per-query review, and no narrowly-scoped, short-lived authorization, so a single compromised AI vendor's tokens cascaded into a 700-organization supply-chain breach at machine speed.

Autonomous actorAutomation was a causal participant—not a decorative label for the system around it.

05BLAST RADIUS // CONSEQUENCES

Where the failure landed

Data from 700-plus organizations' Salesforce environments was exfiltrated over roughly ten days. Numerous named security and infrastructure vendors confirmed impact, and the harvested support-case text exposed downstream secrets (AWS keys, VPN and Snowflake credentials) that enabled further intrusion attempts. Salesforce removed Drift from the AppExchange, Salesloft took Drift offline, and all Drift OAuth tokens were revoked, breaking the integration for every customer. The incident triggered a FINRA cybersecurity alert and broad emergency credential-rotation efforts across the affected ecosystem, and became a reference case for the systemic risk of standing OAuth grants held by AI/SaaS integrations.

06 // EVIDENCE STATUS

Reported

Documented in the cited public record. Follow the sources for the precise evidentiary posture.

SOURCE RECORD UPDATED 2026-07-09

07 // SOURCE LEDGER

2 cited records

01
Secondary / analysisKrebsOnSecurity: The Ongoing Fallout from a Breach at AI Chatbot Maker Salesloft
02
Secondary / analysisThe Hacker News: Salesloft Takes Drift Offline After OAuth Token Theft Hits Hundreds of Organizations

08CONTROL FAILURE // MISSING GOVERNANCE

Trust boundaries, least privilege, and output approval

The failure pattern in this case: Untrusted input crossed a privileged boundary.

09INTERVENTION POINT // HUMAN IN THE MIDDLE

The moment the path could change

A security owner approves credential scope and externally visible actions before the agent can cross a trust boundary.

AI PROPOSES→HUMAN OWNS THE DECISION→SYSTEM EXECUTES

10CONTROL DEPLOYMENT // AUTHORITYGATE

Trust boundary policy · output approval

The AuthorityGate Operational Resilience framework requires a human SME review gate on every third-party AI integration's authorization scope and on any anomalous bulk data access, rather than trusting a vendor's standing OAuth grant indefinitely. A named data-governance SME must validate and re-approve each AI connector's token scope on a fixed cadence, enforcing least-privilege, short-lived tokens instead of long-lived broad grants, and any access pattern that deviates from the chatbot's normal interactive footprint (record-count reconnaissance, object mapping, full-table bulk exports) is held in a pending state pending human sign-off before data leaves the tenant. Under that change-validation gate, UNC6395's mass export of 700 organizations' Salesforce records using replayed AI tokens would have stalled at the first unreviewed bulk-export event instead of running unflagged for ten days.

CASE QUESTIONS // ANSWERED FROM THE RECORD

What happened in the Salesloft AI incident?

What role did AI play in the Salesloft incident?

Which governance control was missing?

Trust boundaries, least privilege, and output approval. A security owner approves credential scope and externally visible actions before the agent can cross a trust boundary.

12 // THE ALTERNATIVE

Autonomy is a design choice.

See the operating model that keeps AI useful while preserving human authority at consequential moments.

Compare AgenticAI and AugmentedAI →