Aug 8, 2025Unverified
Stolen OAuth tokens for Drift AI chatbot expose 700+ Salesforce customers
AI loose in the worldData exfiltrationDERIVED
Approved by person, Oct 11, 2026. How entries are approved
The threat actor tracked as UNC6395 used compromised OAuth and refresh tokens for Salesloft's Drift AI chat agent to impersonate the trusted integration and query the Salesforce instances of more than 700 organizations between August 8 and 18, 2025, exfiltrating stored secrets including AWS keys and Snowflake tokens. On August 20 Salesloft and Salesforce revoked all Drift tokens and pulled the app from the AppExchange.
What this means for youIf your company uses Salesforce or connected AI tools, its stored passwords and access keys may have been copied, so ask whether it has rotated them. At home, this matters mainly if you are a customer of an affected business and it may contact you about exposed data.
Sources
- Google Threat Intelligence Grouphttps://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2360. It has not been edited since it was approved; the hash above would not match if it had. How to verify