Breach anatomy
Stolen OAuth tokens of an AI chat agent used to export Salesforce data
Salesloft's Drift chat agent held OAuth access and refresh tokens for its customers' Salesforce instances and other integrations. Between 8 and 18 August 2025 an actor who had obtained those tokens used them to run queries and bulk exports against hundreds of instances, then searched the exports for cloud keys and passwords. The tokens were accepted from wherever they were presented, so a credential issued to one agent vendor became a key to every tenant that had connected it. Salesloft and Salesforce revoked all Drift tokens on 20 August. Short-lived, sender-constrained tokens and a narrow scope per integration limit what a stolen token can do; this incident is why those controls exist.
- Class
- Token theft
- Disclosed
- Fixed
- All Drift access and refresh tokens revoked on 20 August 2025; the integration removed from the Salesforce AppExchange
- Affects
- Salesloft Drift integrations with Salesforce and, for a few accounts, Google Workspace
- More than 700 organizations that had connected Drift
- Sources
- https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift cloud.google.com
- https://blog.cloudflare.com/response-to-salesloft-drift-incident/ blog.cloudflare.com
- https://unit42.paloaltonetworks.com/threat-brief-compromised-salesforce-instances/ unit42.paloaltonetworks.com
The control that was missing
No requirement in the MCP auth atlas stands for this control yet. The summary above says what it is; a requirement is added to the atlas when a specification revision states it, not before.
Replay in the explorer
No scenario in the explorer replays this pattern yet. The incident is recorded here from its public notice; a replay follows when a baseline chain exists for it.