Salesforce and Anthropic Launched Claudeforce Together. Everyone Who Vouched for It Works at One of Them.

Salesforce and Anthropic announced Claudeforce on August 26, hours before Salesforce reported second-quarter results. Marc Benioff and Dario Amodei went on CNBC together. The results were good. Revenue rose 11% to $11.3 billion and non-GAAP earnings per share more than doubled to $5.90. Salesforce raised its full-year guidance. The stock jumped in extended trading, and Benioff opened the analyst call by telling the room "This is not the SaaSpocalypse."

The product underneath is called Salesforce in Claude, a plugin with 37 prebuilt sales skills. Meeting prep, deal health review, pipeline review. It works against live CRM data through Salesforce's MCP servers. Pilot customers have it now. Open beta comes in September, with more skills later in the year.

Most of the coverage landed in the same place. Salesforce is embracing its own disintermediation, the argument goes, because the moat was never the interface anyway. Nothing wrong with the reading, except that Salesforce supplied it.

Two things went largely unremarked. The product came out of Anthropic's own office. And on launch day, nobody outside the two companies said a word about it.

Anthropic was already doing it

VentureBeat's Michael Nuñez got Patrick Stokes, Salesforce's president of applications and marketing, on the record about the build.

In April, at its TDX developer conference, Salesforce shipped Headless 360, a set of APIs, MCP servers and CLI tools that let agents reach Salesforce data and governance rules directly, with no interface attached. Customers started wiring those MCP servers into agentic interfaces on their own, and Claude is where most of them landed.

It went badly. Every user had to know what an MCP server was, find the right one, connect it and somehow carry their own permissions across, which is not something the average knowledge worker is ever going to do.

Salesforce took the problem to Anthropic. According to Stokes, Anthropic's answer was that this was already how it ran its own sales organization. Anthropic reached Salesforce almost entirely through Claude, with a library of skills and a set of MCP servers behind it. The two companies then packaged that internal configuration up as a CoWork plugin, replacing the per-user wiring with a single admin-level connection.

As product development goes, that's a good sign. Shipping the thing your own team already refuses to work without beats most roadmaps, and none of this is a criticism. It does, though, mark the edge of what has actually been tested.

The reference org is five years old

Salesforce's whole argument for surviving the agent era rests on accumulated context. Stokes made the point directly, saying the value sits in the data, the metadata and the years of workflow and business practice encoded underneath, not in the UI or the application. Benioff's version, in the launch release, is that "probabilistic intelligence alone doesn't run a company." The launch materials describe a frontier model without that context as "a genius who's never seen your deals."

Anthropic was founded in 2021. Whatever sits in its Salesforce instance, it isn't decades of encoded workflow. Five years is the ceiling, and those five years belong to a young company whose org was stood up recently by technically fluent people who have never once had to migrate it anywhere.

The deployment that proved the concept has the least of what the concept depends on.

None of that means Claudeforce falls over in a normal enterprise. It does mean the proof skipped the hard part. An org that is young and tidy tells you almost nothing about one that has survived a decade of migrations, acquisitions and admin turnover.

Nobody checks the read path

A skill is a set of instructions the model reads to work out how to handle a task. Claude checks whether one of them matches the request, follows it, then executes against the MCP server. The 37 that shipped have a view of selling baked into them, down to what a stage transition means and which fields carry the signal.

Salesforce's answer to the variation problem is that actions route back through Salesforce, so business rules get enforced whenever the agent writes. That covers the write path well.

It does not cover the read path. Nothing in the architecture checks whether a skill's model of pipeline health matches yours. The Salesforce DevOps vendor Gearset uses a representative example in its technical debt guide: an Account object that has picked up 347 custom fields over the years, more than half of them no longer in active use. Point a deal-health skill at something like that and the skill will select a field, reason confidently, and route a wrong answer through governance correctly.

Nothing gets blocked. You just end up with a plausible answer that nobody can trace back to a source.

Ten thousand clicks was a rate limit

The strongest technical claim made on launch day was about security. The MCP server inherits whatever permissions the user already has, so a record the seller can't see stays invisible to the agent too. An admin connects the thing once, and there's no per-account re-auditing to do afterwards.

All of that is accurate as far as it goes, but the claim is carrying more weight in the pitch than it can really bear.

Inheritance is only as sound as the model being inherited, and permission debt is one of the most common findings in any mature Salesforce org. Gearset's same guide describes the pattern: a dozen overlapping permission sets, no clear documentation, and no reliable way to know who actually needs what. Connecting to something like that isn't a security control so much as a security assumption, made once, at connection time, on behalf of everybody in the org.

The scale changes too. Salesforce sharing rules were written for a human clicking through one record at a time, and Stokes put a seller's morning triage at somewhere around 10,000 clicks. All that friction was quietly doing the job of a rate limit. Over-permissioning that would have taken a determined employee a week to exploit now resolves in thirty seconds, on request, in plain English.

Anthropic's org is once again the best possible case, young and clean and provisioned by people who understand MCP. Most orgs aren't. Whether yours holds up is a question about your own permission inventory, and the answer isn't going to be in anybody's press release.

No customers were quoted

Go back through the launch-day evidence and look at who was speaking.

The reference deployment is Anthropic's own sales org. The demo was run by a Salesforce VP of product management. Stokes's adoption anecdote, about every sales executive turning up to a business review with a self-built command center, came from Salesforce's own leadership summit in Hawaii. And the headline productivity figure, 8.1 million annualized hours from Claude-powered Slackbot, is Salesforce measuring Salesforce.

Pilot customers exist, but none of them were named and none were quoted.

That's normal enough for a launch timed to an earnings call, and none of it suggests anything has gone wrong. But it does mean that as of today the case for Claudeforce rests entirely on two vendors describing how they use each other's products. Bloomberg reported in June that Salesforce's stake in Anthropic was worth around $5 billion. Benioff told the All-In podcast in May that Salesforce expects to spend roughly $300 million on Anthropic tokens this year. Anthropic, for its part, runs its own business on Salesforce and Slack.

Before you connect it

Whether this works isn't really in doubt. Inside Anthropic it works well enough that two companies built a product around it. The harder question is whether your org looks anything like the org it was built in.

Three questions will get you most of the way there, and you can answer all of them this week. How old is your Salesforce instance, and how many migrations has it been through? Can you produce a current inventory of your permission sets with a name attached to each one, rather than just a list of them? And do the fields those 37 skills reason over map onto fields your team still actually maintains?

If the answers are good, the September beta is a cheap test and worth running early.

If they're bad, the plugin will connect in one click anyway, inherit your permissions anyway, and hand back fluent, confident, well-governed answers drawn from whatever your org happens to contain. The software won't have failed; it'll just have described your org back to you faster than anything ever has.