CX Platform AI Pipelines Become Active Attack Surface After 700-Org Breach
The Development
A supply chain attack disclosed in August 2025 compromised Salesloft's GitHub environment, enabling attackers to steal Drift chatbot OAuth tokens and access Salesforce environments across 700+ organizations—including Cloudflare, Palo Alto Networks, and Zscaler. No malware was deployed. Attackers moved laterally through approved API calls, scanning stolen data for AWS keys, Snowflake tokens, and plaintext passwords. The breach exposed a structural gap: CX platforms like Drift and Qualtrics—which processes 3.5 billion interactions annually—connect directly to HRIS, CRM, and payment systems, yet receive none of the security posture management applied to enterprise platforms like Salesforce or ServiceNow. CrowdStrike's 2025 Threat Hunting Report found 81% of interactive intrusions now use legitimate access rather than malware, with cloud intrusions surging 136% in the first half of 2025. Proofpoint found 98% of organizations have DLP programs, but only 6% have dedicated resources to enforce them.
Our Take
The Salesloft-Drift breach is a marketing operations problem wearing a security badge. Marketing teams configure CX integrations, hold admin privileges, and retire campaigns—but almost never revoke the OAuth tokens connecting those tools to live enterprise systems. Every zombie token is an open lateral movement path that the SOC cannot see because the authentication it uses is valid. The real exposure here isn't technical—it's organizational. Security teams classify CX platforms as survey tools while marketers treat them as pure workflow infrastructure. Neither group owns the gap between them. CrowdStrike and Qualtrics are building toward a purpose-built control layer, but until that matures, the practical liability sits with whoever last ran a CX campaign and never cleaned up the credentials. That's almost always marketing.
The Exploit
Action Item
If your team has run any CX or chatbot campaign in the past 12 months, pull every OAuth token issued to those platforms this week and revoke anything not tied to an active, documented workflow before Q2 2026 planning locks your IT roadmap.