Overview
Agentforce is Salesforce’s platform for AI agents that work inside CRM. The distinction from a chat assistant matters: an Agentforce agent is given Topics and Actions, so it can look up a record, answer a customer and run a Flow without a person pressing the button. Salesforce announced it in September 2024 and shipped the current generation, Agentforce 360, into general availability on 14 October 2025 at Dreamforce, with roughly 12,000 customers already on the platform in some form.
Growth has been fast and the disclosure is partial. For the quarter it reported in December 2025, Salesforce put Agentforce annual recurring revenue at about $540 million, up roughly 330 percent year on year, and said 9,500 of about 18,500 Agentforce deals were paid rather than trial. Trade coverage of the following quarters cites ARR above $1 billion. The company’s earnings releases give ARR but do not break out how many customers actually pay, so one third-party analysis reads the same 9,500 figure as about 6 percent of Salesforce’s roughly 150,000-customer base, with another 9,000 or so on free tiers. More than half of new Agentforce bookings came from existing customers expanding, which tells you this is largely being sold into orgs that already run on Salesforce.
Pricing is consumption-based. Reported list pricing, from trade coverage rather than a published rate card, is $500 per 100,000 Flex Credits, with a standard agent action costing 20 credits, about ten cents, and a voice action 30. Unused credits are reported not to roll over. Per-user licences and a per-resolution price for support conversations also exist, and the same coverage notes that customers on early bundles have had trouble working out what they are consuming.
What It Knows About You
Agentforce collects almost nothing new about anyone. That is the honest starting point, and it is why this entry does not score privacy the way a smart speaker does. What Agentforce changes is who and what can reach the customer data your organisation already holds, and where copies of it travel.
Salesforce’s Trust Layer documentation describes zero data retention agreements with its third-party model providers, so a prompt carrying customer records is not meant to be kept by the model vendor after the response comes back. Salesforce does not position your CRM data as training material for its models. Those are real protections and more than several competitors document.
There is one gap worth checking before you deploy, and it comes from Salesforce’s own training material rather than a critic. The Trailhead module on the Trust Layer states that LLM data masking is currently disabled for agents. Masking is available for embedded features such as Einstein Service Replies and Einstein Work Summaries, and a separate Salesforce-based guide reports that pattern-based and field-based masking does not apply when a prompt template is invoked through an agent. Plenty of general write-ups describe masking as covering everything that leaves the org. For the agent path, the one being sold hardest, Salesforce’s documentation says otherwise.
For the customer on the other end, the exposure is simpler. Your conversation is a record. It is grounded against your contact history, your open cases and whatever Data Cloud holds about you, and it is retained on the same terms as the rest of the CRM.
The Real Risks
A web form was enough to pull records out of a live org. Noma Security reported a vulnerability chain it called ForcedLeak to Salesforce on 28 July 2025 and disclosed it on 25 September, with a CVSS score of 9.4. The payload went into the description field of a Web-to-Lead form and sat there until an employee asked Agentforce to process the lead. The agent’s answer then placed CRM email data inside an image URL on an expired domain that was still on Salesforce’s allow list, which the researchers had bought for about five dollars. Loading the image delivered the data. Salesforce began enforcing Trusted URL allow lists for Agentforce and Einstein generative AI agents on 8 September 2025, which closes that exit route. Noma’s own assessment is that structural fixes to how the model separates instructions from data remain out of reach. Note what the attacker did not need: no credentials, no account, no access to your org.
Salesforce’s own research lab measured the accuracy, and published it. CRMArena-Pro, from Salesforce AI Research in May 2025, tested nine frontier models across 4,280 queries on realistic CRM work. Leading agents reached about 58 percent success on single-turn tasks and fell to roughly 35 percent once the task ran over multiple turns. Workflow execution did better, above 83 percent single-turn, which fits what the product is good at. The finding that should stop a CRM buyer is different: every model tested showed near-zero confidentiality awareness, and prompting them to behave better on that front reduced their task accuracy. That is the vendor’s own paper.
The vendor is the displacement case study. Speaking in early September 2025, Marc Benioff said Salesforce had taken its support organisation from about 9,000 people to about 5,000, “because I need less heads”. Salesforce’s statement tied the change to Agentforce and said it no longer needs to actively backfill support engineer roles, and that it had redeployed hundreds of people into professional services, sales and customer success, so some of this is attrition rather than redundancy. Reported alongside it: support costs down 17 percent since the start of 2025, with AI handling around half of conversations. Benioff has also said AI and human agents each handled roughly 1.5 million conversations at comparable customer satisfaction scores. He sells the product, so treat the satisfaction parity as a vendor claim. The headcount figure is a company describing its own payroll, which is a different kind of evidence.
A connected agent is a credential that reads your customer database. The clearest demonstration is not Agentforce. Between 8 and 18 August 2025, attackers used OAuth and refresh tokens stolen from Salesloft’s Drift AI chat agent to extract records from Salesforce tenants. Salesforce described hundreds of tenants belonging to organisations of specific interest as targeted, tokens were revoked on 20 August, and Drift was pulled from AppExchange pending investigation. Reporting indicates the attackers then combed the exported data for AWS keys, Snowflake tokens and passwords. Different vendor, identical shape. Every agent integration you authorise is standing permission to read customers.
On bias, the honest answer is that there is no documented finding against Agentforce, and this entry scores it low for that reason. The structural concern is not imaginary: a University of Washington study published in 2026 found that models from Google and OpenAI scored American and British speakers higher than Chinese and Nigerian speakers reading the same script, which is a live question for any agent fronting voice support. Nobody has published that measurement for Agentforce specifically.
Alternatives
- Deterministic Salesforce automation. Flow, assignment rules and macros do a large share of what agentic demos show, with predictable cost, no injection surface and behaviour you can read off a diagram. If the use case is routing and templated replies, this is the comparison to beat.
- Retrieval and drafting with a human sending. Narrowing the agent to summarising a case and proposing a reply keeps the Trust Layer protections that do apply, keeps a named person accountable for what the customer receives, and sidesteps the multi-turn accuracy drop.
- Rival agent platforms. Microsoft Copilot Studio, ServiceNow and Zendesk AI sell the same category with different pricing and different lock-in. Switching vendor does not solve prompt injection, because nobody has solved it.
- The low-tech option, stated honestly. More support staff, better internal tooling and a searchable knowledge base cost more per ticket and scale worse at 3am. They also do not have a 35 percent multi-turn success rate, and a person who gets something wrong can be asked why.
Our Verdict
D, as of November 2026, and not because the product fails to work. It works, which is the problem the grade is picking up. The job displacement score is a 9 because the vendor cut 4,000 roles from its own support organisation and sells the software it credits for that. Lock-in sits at 8 because agents are built out of Salesforce metadata, Data Cloud grounding, Flow actions and prompt templates, none of which leaves with you; your records export cleanly, your automation layer does not, and credits reportedly expire unused.
Privacy scores 5, which is lower than this site’s average, because the protections Salesforce documents are genuine and it is not building an advertising profile out of your pipeline. Bias scores 3 because there is nothing documented to point at.
What would move it up: Salesforce enabling LLM data masking on the agent path rather than only on embedded features, a structural answer to indirect prompt injection instead of URL allow lists, published multi-turn accuracy from real customer orgs, and Flex Credits that survive the month. What would move it down: a confirmed exfiltration from a production org, or a customer-facing agent acting on a record without a human able to see why.