Salesforce just told the market its AI agent business grew 200%.

The number is a narrative weapon. But the underlying mechanics reveal a different story. The growth is not a model breakthrough. It is a pricing experiment wrapped in an enterprise integration play. And the security posture around it has holes most analysts will not see because they are staring at the revenue line.

I have spent the last 18 years auditing this space. I have pulled apart smart contracts for integer overflows and traced race conditions in fraud proof windows. When I look at Agentforce, I do not see a magic AI product. I see a model router with a billing meter attached. The real risk is not the model. It is the business logic binding the model to the CRM.

Context: The Orchestration Layer, Not The Brain

Agentforce is not a foundation model company. It is an orchestration company. The core is the Atlas Reasoning Engine, which routes prompts to a mix of external models—OpenAI, Anthropic, Google. The output is then mapped to CRM objects via "Atomic Actions." This is a systems integration play. The value is not in the neural weights. It is in the engineering that forces a generic model to talk to a sales pipeline without corrupting the data.

Tracing the invariant where the logic fractures—the invariant here is the mapping between an LLM's text output and the structured fields of a CRM. When the model says "customer is angry," the system must translate that into a severity field and a workflow. That translation layer is where the abstraction leaks. The leaks are measured in customer churn and, worse, in security incidents.

Salesforce has deep integration with its Data Cloud. The model gets real-time access to structured business data—customer records, order histories, service tickets. This is the real moat. A general model trained on public internet data cannot replicate that access. But access is a vector. More access means more surface area. The trust layer is the only fence.

The pricing model is the other core mechanic. Agentforce is priced at $2 per conversation. This is a shift from the seat-based license to a consumption-based. It aligns revenue with actual value delivered. It also transfers all the risk to Salesforce. If the agent fails to complete a task, the client stops paying. And the client will stop paying. The numbers will show it.

This is not a breakthrough. It is a pivot.

Core: The Economics of the $2 Trap

The $2 per conversation price looks simple. The underlying economics are not. Salesforce pays for inference to the model providers. OpenAI and Anthropic charge per token. The cost per call depends on the model, the context window, and the complexity of the workflow. The $2 price has to cover that inference cost, plus the cost of the orchestration engine, plus the trust layer, plus a margin.

The margin is under pressure. When the model is a commodity, the cost is variable. But the price is fixed at $2. If the model complexity increases, the cost goes up. Salesforce has negotiation power as a major buyer, but the power is not absolute. The model providers know that Agentforce is a dependency.

The abstraction leaks, and we measure the loss in the profit margin. Every conversation is a single ledger entry. It is a tiny bet. But when you have millions of conversations, the bet compounds. The growth of 200% is not a sign of health. It is a sign of scale. The scale without unit profitability is a ticking clock.

The negative incentive loop is visible in the design. The agent can get the right answer but the client might not be satisfied. The client asks for a callback. That is a new conversation. The agent fails to resolve a complex issue, and the client has to start over. Each failure is a new $2 charge. The client's cost is unpredictable. The agent's incentives are perverse. This is the core contradiction.

From my audit experience, I can say this: the unit economics of a $2 conversation are only viable if the agent resolves the issue in the first call. The first call is the cheapest. If the agent fails, the cost is not just the second $2. It is the cost of customer churn. The ROI is only positive when the agent is accurate and the business process is highly standardized. The long-tail processes are where the model breaks.

I have done this exercise. I have looked at the ZK proof generation and found a race condition that could freeze funds for 7 days. The same principle applies here. The race condition is the market. The model is not the risk. The risk is the orchestration.

The Contrarian: The Security Blind Spot

The financial model is one thing. The security is the larger issue. The Einstein Trust Layer provides data masking and prompt injection protection. It is designed to keep customer data from leaking to the model. It is a good start. But it is not a complete solution.

The agent is a prompt injection vector. A malicious user can craft a prompt to manipulate the model. The model, following its reasoning, might take an action that violates the business rules. The Trust Layer is a shield, but the shield is not the system. The system is the entire workflow.

Metadata is memory, but code is truth. The code is the orchestration logic. The metadata is the client's data. The security posture is measured by how well the two are separated. If the model can access the data, it can be tricked.

The trust layer masks sensitive data. It does not solve the alignment problem. The agent is trained to follow business rules. But the rules are not the model. The model is a foreign component. The rules are the guardrails. The guardrails are only as strong as the code that implements them.

This is the hidden dependency. The agent's autonomy is a promise. The code does not guarantee it. The model can act. The trust layer can block. But the agent can act outside the boundary if the orchestration logic is flawed. And the orchestration logic is a software stack. It has bugs. Every stack has bugs. The question is not if, but when the bug is hit.

This is the blind spot. The market is focused on the revenue and the 200% growth. They are not focused on the prompt injection attack surface. They are not looking at the security of the action layer. The trust layer is a starting point, but the agent is a new frontier.

Friction reveals the hidden dependencies. The friction is the user's attempt to make the agent do something it is not designed to do. The agent is a tool. The tool can be used for good or for bad. The trust layer is the policy. The policy is the boundary. The boundary is only as strong as the code that enforces it.

Takeaway: The Vulnerable Forecast

The growth is real, but the base is small. The revenue is a fraction of the total. The story is not a story of a new engine. It is a story of a repackaging of the existing CRM. The market is pricing in the future. The future is not guaranteed.

The security model is the chokepoint. The per-conversation pricing is the revenue model. The two are coupled. If the security fails, the revenue falls. If the cost of inference is too high, the margin falls. The unit economics are the engine. The security is the brakes.

The question is not whether Salesforce can grow the agent business. The question is whether the growth is sustainable. The growth is a function of the base. The base is the existing client base. The expansion is a penetration. The penetration is a cost. The cost is the security.

I have seen this before. I have seen the model break. The crash is not the model. The crash is the system. The system is the orchestration. The orchestration is the code. The code is the truth. The truth is the risk.

The agent is the edge. The edge is the point of failure. The failure is the cost. The cost is the churn. The churn is the number. The number is the next quarter's report.

Reverting to first principles to find the break: The first principle is that the agent is a computer program. The program has a bug. The bug is in the logic. The logic is in the action. The action is the decision. The decision is the point of failure. The failure is inevitable. The question is the timing.

Precision is the only reliable currency. The market is imprecise. The metric is the growth. The precision is the unit economics. The unit is the $2. The cost is the inference. The margin is the difference. The difference is the profit. The profit is the sustainability. The sustainability is the forecast.

The forecast is the question: Can the orchestration layer hold up? The answer is a function of the code, not the pitch.