Salesforce just slammed the proverbial door on one of the sneakiest backdoors in the ecosystem: uninstalled connected apps.
If you’ve ever authorized a random tool without thinking, congratulations friend — you’ve basically left your organization wide open for a hacker with a decent enough phone scam. (With AI, they're getting much better at that, too.)
The big headline: starting in September, writes Salesforces, only highly trusted users with new, explicit permissions can run uninstalled connected apps.
Everyone else gets blocked. Device flow apps? Gone.
Why this matters:
- Social engineering is the real threat. ShinyHunters didn’t break into Salesforce’s core — nope, they simply tricked people into installing fake Data Loaders. The attack vector wasn’t the platform, it was the human.
- The ecosystem’s shadow IT problem is massive. Your org doesn’t live neatly in Salesforce objects. (Psh, I wish.) It sprawls across inboxes, spreadsheets, and random apps your ops team forgot about. Each one? A potential point of breach.
- Governance just became non-optional. Salesforce is forcing admins to own their connected app hygiene. Good luck. Audit what’s installed, block what you don’t trust, and stop letting every curious, doe-eyed end-user plug random tools into your CRM. (Sorry to any end-users out there.)
Sweep's POV on the whole matter: Well, this is exactly why we keep hammering on metadata visibility.
You can’t secure what you can’t see. If your org is riddled with blind spots— unused flows, hidden integrations, “who in the Sam Hill hell authorized this?” apps — you’re not just exposed, you’re basically inviting the attackers in.
Salesforce’s move shrinks the attack surface.
But Sweep? We can help you map it entirely.
The real risk isn’t the platform itself, obviously. It’s sprawl.
If you’re serious about Agentforce, Data Cloud, or just keeping customer trust intact, this is your wake-up call: clean house, or get cleaned out.
