Claude Cowork / Salesforce Insider Threat Simulation
What Happened
strong>This case documents a controlled vendor simulation, not a confirmed real-world incident. No organization was breached and no actual data was exfiltrated.
In June 2026, DTEX published an i3 Threat Advisory examining how AI agents operating as "non-human identities" (NHIs) in corporate environments expand the insider threat surface. To develop behavioural detection indicators for a forthcoming intelligence release, DTEX researchers ran a series of laboratory simulations using Anthropic's Claude Cowork, its browser plugin, and the Dispatch feature that relays commands from a mobile device to a desktop agent.
In the simulated use cases, the agent summarized Salesforce records and placed the output into a draft Outlook email, and performed file-archive transfers. The full simulated chain—reconnaissance, aggregation, exfiltration staging, and track-covering—completed in between 10 and 24 minutes depending on the tool combination used. DTEX's stated conclusion was that such activity is difficult to distinguish from ordinary employee behaviour using conventional DLP tooling, and that organizations should prioritize AI agent visibility, prompt analysis and endpoint attribution.
Why this case is retained despite being a simulation: MEG treats validated attack-path demonstrations as legitimate governance evidence when the capability is confirmed and only the malicious intent is absent. The mechanism is real; the harm is projected. Conclusions below are therefore framed as anticipatory allocation, not as findings against identified parties.
Related grounded case: For a documented (non-simulated) Cowork exfiltration mechanism, see the PromptArmor demonstration of indirect prompt injection causing Cowork to upload user files to an attacker-controlled Anthropic account.
Source: DTEX i3 Threat Advisory, June 2026 (vendor laboratory simulation). Epistemic label: Probed — capability demonstrated under controlled conditions; no field incident confirmed.
How MEG 1 would have acted
In the simulated configuration, the agent operated with permissions sufficient to complete a full exfiltration chain without triggering governance checks. Assessed against MEG as a projected failure of workplace safety and informational integrity, contingent on the configuration being reproduced in production.
MEG 2 Analysis - Legal Framework
Agent level: N3 (individualized/advanced) - persistent workplace agent with OAuth access to multiple enterprise platforms (Salesforce, Outlook, local files) and high execution autonomy.
Cause (6.1) — projected, not attributed:
(a) system defect - absence of behavioural boundaries and request-provenance validation in the Dispatch relay and enterprise integration path, such that a single-turn instruction can initiate a cross-platform data movement without independent authorization. Attributable to the manufacturer in any deployment reproducing this configuration.
(b) autonomous decision error - would apply if, in a live deployment, the agent completed an unauthorized extraction without verifying the legitimacy of the request. Not established here, as no live request occurred.
Attachment of liability (anticipatory): No liability attaches on these facts, as no incident occurred. Were the demonstrated chain to execute in production, liability would be expected to divide between the operator, for failing to restrict agent API scopes under least privilege (9.4), and the manufacturer, for the design defect at 6.1a. This case is used for control design, not for adjudication.
Procedural Mechanism
6.2 (architectural human confirmation): Cross-platform operations involving the exfiltration or transferring of sensitive customer data (such as Salesforce records) must require strict, out-of-band architectural human confirmation. The agent must be technically blocked from executing bulk data transfers without independent authorization.
7.1 (independent forensics): Every transaction, data extraction, and tool call executed by the agent must be securely logged in an unalterable, independent ledger to detect anomalous exfiltration patterns in real-time.
9.4 (least privilege): Granting an assistant agent standing read/write permissions to both the corporate CRM and external messaging apps violates the principle of least necessary access.