Stolen OAuth tokens for Drift AI chatbot expose 700+ Salesforce customers
Salesloft (Drift) · Aug 8, 2025 · Customer service agent
What happened
The threat actor tracked as UNC6395 used compromised OAuth and refresh tokens for Salesloft's Drift AI chat agent to impersonate the trusted integration and query the Salesforce instances of more than 700 organizations between August 8 and 18, 2025, exfiltrating stored secrets including AWS keys and Snowflake tokens. On August 20 Salesloft and Salesforce revoked all Drift tokens and pulled the app from the AppExchange.
Causal vector
Stolen OAuth tokens let attackers act with the AI integration's full standing privileges for ten days
Source
Reported by Google Threat Intelligence Group. Verified against the primary report.
A stolen token is indistinguishable from the agent itself — unless every high-volume action passes a policy gate. Velocity limits on record reads and a category rule flagging bulk exports would have surfaced the exfiltration queries on day one instead of day ten.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
15 malicious JetBrains plugins silently exfiltrated developers' OpenAI, DeepSeek and SiliconFlow API keys
JetBrains Marketplace (third-party plugin authors) · Jun 10, 2026
Compromised LiteLLM PyPI packages harvest credentials via supply-chain attack
LiteLLM (BerriAI) · Mar 24, 2026
Step Finance treasury drained in $27–40M exploit
Step Finance · Jan 31, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.