#SaaS Security
All CosmicBytez Labs articles tagged #SaaS Security, across news, security advisories, how-to guides, and projects.
- News
From Email-to-Case to the Boardroom: How Inherited AI Agents Break Governance Built for Software
Email-to-Case and Web-to-Case let anonymous senders reach Salesforce Agentforce AI agents, exposing governance gaps vendor reviews and prompt filters both miss.
- News
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
Amazon blocked Meta's Muse for not disclosing it was a bot, as personal AI agents like Instinct and OpenClaw gain unmanaged access to corporate SaaS logins.
- News
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
A 2026 report finds roughly 1,280 third-party products now embed AI, but only 282 sit behind SSO, leaving about 1,000 agents invisible.
- News
OAuth Grants Pile Up Faster Than You Can Review Them — Here's How to Keep Up
OAuth grants are piling up faster than security teams can review them, and the Klue breach shows how one forgotten credential exposed data at dozens of firms.
- News
The EDR Blind Spot: 3 Ways Browser Attacks Evade Endpoint Telemetry
AiTM phishing, malicious extensions, and clipboard-hijack attacks finish inside the browser, leaving little for endpoint detection tools to catch.
- News
'Salesbleed' Exploits Salesforce Agentforce to Enable Anonymous Slack Phishing
Zenity Labs: chained Agentforce flaws let attackers bleed CRM data via Web-to-Lead forms, then hijack a trusted agent to phish staff in Slack.
- News
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Dubbed 'City Forum,' a single threat actor has been silently scraping customer portals across Salesforce and ServiceNow for over a year.
- News
Klue OAuth Breach Victim List Grows as Icarus Hackers Claim Attack
Market intelligence platform Klue has confirmed attackers stole OAuth tokens connected to customers' Salesforce environments, as the Icarus extortion...
- News
Salesforce Data Thefts Continue via Klue App Compromise
Klue's Battlecards competitive intelligence application has become the third integrated app compromised in the ongoing Icarus campaign targeting...
- News
Video Service Vimeo Confirms Anodot Breach Exposed User Data
Vimeo has confirmed that customer and user data was accessed without authorization following a security breach at Anodot, a data anomaly detection...
- News
Shadow AI in SaaS: How Hidden AI Agents Are Enabling
A new Grip Security report analyzing 23,000 SaaS environments finds 100% of companies operate shadow AI they cannot see or control — with a 490% spike in...
- News
Shadow AI Is Everywhere. Here's How to Find and Secure It.
Shadow AI is quietly spreading across SaaS environments as employees adopt new AI tools without IT oversight. Security teams can discover AI apps, monitor...