Salesforce Turns Agentforce On by Default in Winter '27

Salesforce has enabled autonomous Agentforce agents by default in Lightning Enterprise, Performance, Unlimited and Developer Edition orgs at no extra cost. The Setup toggle to disable Agentforce is being removed, raising risks as agents inherit accumulated user permissions and can execute CRM workflows at API speed.

• Agentforce is on by default in Enterprise, Performance, Unlimited and Developer Edition
• The Setup toggle to turn Agentforce off is being removed
• Agents inherit full user-context permissions, including stale access grants
• The 2025 ForcedLeak flaw (CVSS 9.4) exploited exactly this configuration