AGENTFORCE-32.1 · Unintended Autonomous Blast Radius

🔐 Enterprise Tier · 🟠 High · Category: Graph: Cascading Automation

Detection Logic

Traces the unintended cascade chain from an LLM-triggered DML operation through an ApexTrigger into async external callouts — automation that the LLM planner, developers, and admins never intended to connect.

graph LR
  FN["GenAiFunc / ActionDef"]
  APEX["ApexClass\n[hasDmlOperations=true]"]
  OBJ["Object\n[e.g. Lead]"]
  TRIGGER["ApexTrigger\n[after insert/update]"]
  ASYNC["@future / Queueable\n[hasExternalCallout=true]"]

  FN -->|TARGETS| APEX
  APEX -->|DML on| OBJ
  OBJ -->|FIRES| TRIGGER
  TRIGGER -->|dispatches| ASYNC
  ASYNC -->|"⚠️ HTTP callout to external system"| ASYNC

What Triggers It

Hop	Condition
1	GenAiFunc / ActionDef → TARGETS → ApexClass[hasDmlOperations=true]
2	ApexClass DML targets a specific SObject (extracted from metadata or heuristic)
3	Object → FIRES → ApexTrigger[events includes afterInsert/afterUpdate]
4	ApexTrigger with hasAsyncDispatch=true AND hasExternalCallout=true

Real-World Scenario

"The Sales Automation Lead Update Blast": An agent action updates a Lead record. An after update trigger fires and dispatches a @future callout to a financial API for lead scoring. The agent was never intended to interact with the financial system — but it does, on every LLM invocation that targets the Lead object.

Remediation

1. Guard the trigger: Add a static boolean flag in the invocable Apex class that the trigger reads to suppress async dispatch when the call originated from an agent action.

// In InvocableLeadUpdate.cls
public static Boolean agentContext = false;

@InvocableMethod
public static void updateLead(List<Lead> leads) {
    agentContext = true;
    update leads;
    agentContext = false;
}

// In LeadTrigger.trigger
if (!InvocableLeadUpdate.agentContext) {
    LeadScoringService.dispatchAsync(newLeads);
}

2. Document the cascade for operations teams — label the trigger with a comment referencing this rule ID.
3. Consider moving the async dispatch to an agent-observable Flow step instead of a trigger.