What is Claude Force, exactly?
The one-word version is Claudeforce — that's Salesforce's own spelling, and it's what you'll see in the announcement. (If you searched "Claude Force" in two words, same thing. Search engines haven't settled; this article covers both.)
Claudeforce is the name for Anthropic's Claude running as a first-class AI inside Salesforce. Announced on 26 August 2026, it puts Claude inside the Salesforce trust boundary as the reasoning model behind the Atlas Reasoning Engine. The launch centrepiece is a plugin with 37 prebuilt sales skills — meeting prep, deal health review, pipeline review among them — with more skills expected to start arriving from late 2026. Claude also powers Agentforce Coworker and Agentforce Vibes by default, and it's the model behind Slackbot for Salesforce customers.
Salesforce expects an open beta in September 2026, with select pilot customers already live. Which means the demos are everywhere right now: connect Claude, ask it something clever, watch it answer. Impressive, and true.
Here's the part the demos don't dwell on.
Everyone says it's easy. It is. That's the risk.
The launch coverage treats the connection as the project. It isn't. The connection is the demo. The permissions, the data residency, the audit trail, and the consumption bill — that's the project.
Start with the mechanics, straight from Salesforce's own documentation. Claude connects to Salesforce via OAuth 2.0 with PKCE, and every call Claude makes runs under the identity of the authenticated user. Not a special robot account. The user who connected it.
So the permissions question is really a question about you. If the person who wires up Claude is a Salesforce admin — and it's usually an admin who does the wiring — then Claude runs with admin power. Modify All Data is one checkbox away, and nobody has to click anything sneaky for that to be true. It's just how the connection works.
That's not a flaw in Claudeforce. It's the design. It's also why "it took an afternoon to set up" is not the safety story people think it is.
What can Claude actually see, touch, and spend?
Salesforce's own framing for the agentic era is Headless 360, and their blog puts it plainly: "Everything on Salesforce is now an API, MCP tool, or CLI command." Everything your org holds is potentially reachable by an agent.
To their credit, Salesforce's docs don't pretend otherwise. They're explicit that the guardrails — object permissions, field-level security, sharing rules — exist and that you build them per deployment, field by field. Their words: "Headless doesn't mean ungoverned. It means that the governance is yours to build."
Read that again, because it's the most honest sentence in the whole launch: the governance is yours to build. The platform will enforce whatever you configure. It will not configure itself.
There are tools for the job. Event Monitoring can capture the client app, the authenticated user, the object, the operation, and the timestamp for every API call — the raw material of a real audit trail, if you set it up before you need it. Agent Fabric (a MuleSoft product) can push least-privilege enforcement down to individual MCP tool calls. But both are things you opt into and configure. Out of the box, the default posture is the identity you connected with, and whatever that identity can reach.
Does Claude write back to Salesforce?
It can — reading and writing travel the same authenticated identity. Whether it should is a per-use-case question, not a product setting.
Meeting prep that reads your calendar and account history? That's a scoped, read-only use case — a reasonable candidate for a direct connection, for this scoped use case. A candidate is never a clearance.
An agent that drafts emails into production records, updates opportunities, or chases leads on its own? That's a write path into your system of record, and the honest answer is that it needs a harness in the middle — a governed layer that checks what the agent is about to do before it does it. Some use cases shouldn't connect to anything yet at all: do the foundations first.
The pattern we see most often is mixed: some reads may connect direct, writes wait for the harness conversation. One blanket answer — "it's easy, just connect it" — is exactly the advice that generates the incident report.
Swarm analysis: read-only is not risk-free. If Claude can read fields anyone can write, those fields can carry instructions. Salesforce's docs don't say this — their own trust model is why it matters. A public wishlist field, a web-to-lead form, a comment thread — any of them can plant text in front of an agent that treats what it reads as instructions. The demos don't show that path. Your org already contains it.
Is my Salesforce data used to train Claude?
Here's where we tell you what the launch materials actually say, and what they don't.
What they say: Anthropic is the first LLM provider fully contained within the Salesforce trust boundary — Claude's traffic for these features stays within Salesforce-managed infrastructure. For regulated industries, Claude is available through Amazon Bedrock inside that same trust boundary.
What they don't say: the announcement materials don't state a position on training data use for your specific configuration. That's not an accusation — it's a gap between "where the data runs" and "what happens to it," and it's a question you should ask both vendors in writing, for your own tenant and contract, before you connect a production org. Don't take our word for it. Don't take a demo's word for it either.
Who's liable when a Claude agent edits the wrong record?
Mechanically: the action is attributed to the authenticated user whose identity Claude is running under. If Claude edits a record, the audit trail shows a person's name on it — which is precisely why the audit trail matters. Event Monitoring's capture (client, user, object, operation, timestamp) is how you reconstruct what the agent actually did.
Legally: that's a question for your legal team and your Salesforce contract, and it's worth asking before the first write path goes live, not after. What we can tell you is this — "the AI did it" is not a defence anyone accepts, and the connected identity is who the system says did it.
How much does Claudeforce cost?
Two cost lines, and the second one is the one that surprises people.
The first is availability: pilot customers have access now, and Salesforce expects open beta in September 2026. Watch the announcement materials for what your edition and contract include.
The second is consumption. Every call Claude makes — every skill invocation, every record read, every generated response — is metered somewhere, and the bill scales with usage. An agent that works harder costs more than one that works less, and an ungoverned agent that loops over your org isn't only a governance risk. It's a billing one. Before you connect anything, know what the meter is, where it's read, and who gets the invoice.
How do you connect Claude to Salesforce safely?
Not with a setting — with a design. The short version of what "yours to build" means in practice:
- Connect through a dedicated integration identity, not a personal admin account. Least privilege starts with who you plug in.
- Configure field-level security and sharing rules for what the agent should reach — field by field, per deployment. The defaults are not a governance plan.
- Design the audit trail before you need it. If you can't reconstruct what the agent did, you can't govern it.
- Decide per use case: direct connection, harness in the middle, or not yet. Reads and writes are different questions. Scope beats scale.
- Plan the escalation path and the kill switch before go-live. The failure mode isn't the agent being wrong; it's the agent being confidently, quickly wrong at scale.
None of that is hard. All of it is deliberate. And almost none of it appears in a launch demo, because "watch us think about permissions" doesn't trend.
Claudeforce is a genuinely significant release — a frontier-class general-purpose reasoning model, wired into the CRM where your customer data actually lives, inside a trust boundary the two companies built together. The opportunity is real. So is the part the launch coverage didn't tell you: everything that makes it easy to connect is what makes it easy to connect carelessly.
The teams that get value from this will be the ones who treated the connection as the beginning of the project, not the end of it.
Before you connect anything, make sure someone has answered the nineteen questions that decide whether your org is ready — and which of your use cases need a harness in the middle. Not sure where to start? That conversation is the work. Get in touch.
Sources
- Salesforce, "Salesforce and Anthropic Announce Claudeforce: The #1 AI Meets the #1 AI CRM" (26 Aug 2026) — announcement date, plugin with 37 prebuilt skills, Atlas Reasoning Engine, Agentforce Coworker and Vibes, Slackbot, open beta timing, late-2026 skills.
- Salesforce, "Headless Doesn't Mean Ungoverned: How Trust Works When Agents Call Salesforce" — OAuth 2.0 with PKCE under the authenticated user's identity, object permissions / FLS / sharing rules built per deployment, the "governance is yours to build" line, Agent Fabric, Event Monitoring fields, Headless 360 "everything is an API, MCP tool, or CLI command."
- Anthropic, "Salesforce and Anthropic expanded partnership" — first LLM provider fully contained within the Salesforce trust boundary, traffic within Salesforce's VPC, regulated-industry availability via Amazon Bedrock.
- Salesforce, "Salesforce and Anthropic Bring Trusted Business Context and AI Actions to Claude Through Slack and Agentforce 360" — Claude in Slack, RBC Wealth Management use case, Agentforce actions from inside Claude (Dreamforce expectation).
- Dreamforce 2026 — 15–17 September 2026, San Francisco (https://www.salesforce.com/dreamforce/).