Anthropic’s announcement of Claude Mythos underscores a reality Salesforce has been preparing for: increasingly capable frontier AI models will continue to accelerate the evolution of the cybersecurity landscape.

Our security teams are continuously evaluating how frontier models like Mythos may change attacker and defender capabilities, and we are applying those insights to strengthen our security posture and guide continued enhancements across our environment.

We view this as an acceleration of work already underway, not a departure from it. Salesforce has long invested in automation and AI to help identify risk, strengthen defenses, and support the trust our customers place in us.

Trust remains our #1 value, and we remain focused on helping protect our customers’ data in a rapidly evolving threat environment.

How Salesforce is preparing for the frontier AI threat landscape

Salesforce is actively monitoring threat activity targeting public-facing Experience Cloud sites, including attempts to take advantage of overly permissive guest user configurations.

At this time, we have not identified any vulnerability inherent to the Salesforce platform associated with this activity. These attempts are focused on customer configuration settings that, if not properly secured, may increase exposure.

We encourage customers to review their Experience Cloud guest user settings and take immediate recommended actions. For additional details and steps to help protect your org, please see our blog: https://www.salesforce.com/blog/protecting-your-data-essential-actions-to-secure-experience-cloud-guest-user-access/

Security Advisory: Protecting Experience Cloud Sites from Guest User Misconfigurations 

Salesforce is actively monitoring threat activity targeting public-facing Experience Cloud sites, including attempts to take advantage of overly permissive guest user configurations.

We have identified additional guidance for customers to help protect their orgs. Please see our updated blog for recommended actions: https://www.salesforce.com/blog/protecting-your-data-essential-actions-to-secure-experience-cloud-guest-user-access/

At this time, we have not identified any vulnerability inherent to the Salesforce platform associated with this activity.

Update

Salesforce is aware of and closely monitoring a phishing campaign appearing as fraudulent emails from Salesforce with a malicious link to download Remote Monitoring & Management (RMM) software.

Our security teams are working diligently to contain this issue and urge all customers to maintain a high level of vigilance against phishing and social engineering attempts, as these remain frequently used tactics by threat actors. If you receive requests from Salesforce to install RMM software, we recommend you validate its legitimacy with Salesforce Support or architect teams prior to taking action by opening up a ticket through the Salesforce Help portal.

For guidance and support, please reach out through the Salesforce Help portal. You can also refer to this article for guidance on how to protect your environments from social engineering threats: https://www.salesforce.com/blog/protect-against-social-engineering/. 

Security Alert: Phishing Campaign with Malicious links

We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support. At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology.
Our security teams are actively working to protect customer environments and data, providing guidance and support. Customers identified as potentially affected have been notified directly. If you have not received a notification, we currently have no evidence suggesting any impact to your account. We continue to monitor the situation closely and encourage customers to remain vigilant against phishing and social engineering attempts, which remain common tactics used by threat actors.

For guidance, please review our blog post (https://www.salesforce.com/blog/protect-against-social-engineering), knowledge article (https://help.salesforce.com/s/articleView?id=005226734&type=1), and reach out through the Salesforce Help portal if you need support.

Security Advisory: Ongoing Response to Social Engineering Threats

Salesforce is monitoring social engineering campaigns targeting third-party identity providers (IdPs) across the industry. In these attacks, threat actors use fraudulent login pages or impersonate IT support through voice calls to steal credentials or MFA codes, or to trick users into authorizing malicious connected apps. If an IdP account is compromised, attackers may attempt to access connected applications.

Please note this issue does not stem from a vulnerability inherent to Salesforce; these attacks rely on social engineering and deceptive authentication prompts.

Our security teams are actively working to protect customers and have notified potentially affected accounts. For guidance and mitigations, please review our blog post (https://www.salesforce.com/blog/protecting-salesforce-data-after-an-identity-compromise/) and knowledge article (https://help.salesforce.com/s/articleView?language=en_US&id=005226734&type=1). For support, contact Salesforce Customer Support via https://help.salesforce.com/s/?language=en_US.

NOSSO VALOR

Nós atuamos como conselheiros confiáveis.

Nós conquistamos a confiança de nossos clientes, funcionários e familiares por meio da transparência, da segurança, da conformidade, da privacidade e do desempenho. E nós oferecemos a infraestrutura mais confiável do setor.

Status por produto

Mensagem informativa

Componentes do Trust

Recursos