How Will Agentforce Affect Security and Compliance?

Salesforce security tools are critical to safely using generative AI tools like Agentforce.

Why It Matters: Generative AI tools are so new that the security implications aren’t completely understood. The industry’s eagerness to implement them could unintentionally introduce data security vulnerabilities into your Salesforce environment.

• According to recent surveys, nearly 52% of generative AI users have reported an increase in their usage of AI tools, showcasing the growing dependence on this technology.
• Another study found that approximately 40% of developers have used generative AI tools without formal approval from their organizations.

Here are five considerations for security and compliance in relation to generative-AI tools like Agentforce:

1. AI-Generated Code Usage
2. Security and Compliance Concerns with AI-Generated Code
3. Common Vulnerabilities with AI-Generated Code
4. Critical Salesforce Security Tools
5. Best Practices for Using Agentforce

1. AI-Generated Code Usage

Generative AI is transforming how developers approach coding. A substantial number of developers have begun to rely on AI tools to generate code, optimize existing codebase, and streamline development processes.

Nearly half of developers have integrated AI tools into their workflow, with a significant portion using these tools daily.

This trend underscores the necessity for robust oversight and governance in AI tool usage. Developers are already using these tools, whether their organizations are providing guidance or not. This unregulated usage highlights the need for clear policies and training on the secure and compliant use of AI in development.

Back to top

2. Security and Compliance Concerns with AI-Generated Code

This technology is new, which means there are a lot of unknowns about how it will impact security and compliance. Here are three main concerns with AI tools like Agentforce:

• Data Storage Concerns: Proper storage and management of customer data is a critical consideration for both security and compliance. Any unknowns relating to this become liabilities.
• Unreliable Code: Internal coding and architectural standards guide your developers as they build new applications and updates. AI tools aren’t going to follow these standards, making AI-generated code stand out from the rest of your coding updates.
• Unknown Data Sources: There’s simply no way around the fact that Agentforce’s coding models aren’t 100% reliable. Generative AI tools are built on public information, so if a pattern is recognized as the solution to a particular query, it’s going to be used whenever prompted.

Back to top

3. Common Vulnerabilities in AI-Generated Code

Code-scanning software repeatedly finds errors in AI-generated code. These vulnerabilities were found after a scan of generated code:

• Potential Security Leakage: Usernames, passwords, contact information, PII, and other sensitive data are stored in unsecured locations or are otherwise accessible by unauthorized individuals.
• XSS Attacks: Cross-Site Scripting (XSS) occurs when an attacker injects browser-executable code within a single HTTP response.
• Cross-Site Request Forgery: An attacker tricks a user into making an unintentional request to the web server, which is then treated as an authentic request because the system doesn’t have a mechanism to verify intentionality.
• SOQL Injection: User inputs are not properly validated before being used in an SOQL query, which exploits Salesforce vulnerabilities.

Back to top

4. Critical Salesforce Security Tools

Coding errors are nothing new. Every development project has issues that need to be resolved. The good news is that there are powerful tools currently on the market that have been perfected over the years to find and flag these errors as soon as they are entered into the system.

Static code analysis is a non-negotiable aspect of utilizing AI-generated code.

Development teams need to introduce a security-first workflow, verifying generated code. Static code analysis is a nonnegotiable aspect of using generative AI tools like Agentforce. Every line of code will need to be checked because of the unreliability of the results.

Back to top

5. Best Practices for Using Agentforce

An intentional, unified approach to using AI tools like Agentforce will have a huge impact on your ability to produce secure updates and applications.

Here are seven things your Salesforce DevOps team can do to secure your environment while using AI:

• Consider Compliance: Ensure usage of the AI model complies with relevant security standards and regulations.
• Limit Access: Control who has access to the AI model and restrict permissions to only those who need it.
• Use Sandboxing: Run the AI model in a sandbox environment to limit its access to system resources and prevent it from executing malicious code.
• Update and Monitor Regularly: Keep the AI model and its dependencies updated with the latest security patches. Monitor usage and performance for any unusual activity that could indicate a security breach.
• Review Generated Code: Leverage a static code analysis tool to review code generated by the AI model before integrating it into your project.
• Require User Authentication and Authorization: Implement strong user authentication and authorization mechanisms to control access to the AI model and the code it generates.
• Provide Ample Training: Mandate security training to developers and users who interact with the AI model to raise awareness of potential security risks and best practices.

Back to top

Next Step…

Information is critical for safely utilizing powerful tools like Agentforce. Failing to utilize the proper Salesforce security tools greatly increases the potential for falling out of compliance due to faulty code.

Check out our ebook, The State of AI Security in Salesforce DevOps, to learn more about the dangers of utilizing AI-generated code and what you can do to stay safe.

Back to top

FAQs

How does artificial intelligence write code?

AI uses machine learning models to write code. These models are trained on huge datasets of existing code by analyzing patterns and structures to generate new code based on the input received. When a developer provides a prompt or a problem description, the AI predicts and suggests the most relevant code snippets. The process involves understanding the context, the programming language involved, and the intended functionality. Over time, AI improves its accuracy and relevance by learning from feedback and new data, making it an increasingly valuable tool in software development.

What are the benefits of using AI to write code?

Developers use AI because it dramatically increases their ability to produce massive amounts of code. AI can quickly generate code snippets, automate repetitive tasks, and suggest improvements, significantly reducing the time developers spend on routine coding. Salesforce managers like AI because it increases a team’s capacity for productivity without increasing the number of developers on the team. Overall, it’s a way of doing more with less while also increasing the output of a development team.

Back to top