Salesforce spent twenty-six years teaching a generation of administrators to live inside its screens. At Dreamforce 2026 in September, in front of roughly 43,000 people at Moscone, Marc Benioff told them the screens were the problem.
The headline product was AIforce, which Benioff pitched as a “live interface” that surfaces Salesforce data and workflows inside Claude, Slack, or a plain terminal, so a person (or an agent) never has to open the core application. Co-founder Parker Harris framed it as a question in VentureBeat’s coverage: “Why should you ever log into Salesforce again?” Benioff called the moment “an interface revolution,” per Salesforce Ben’s recap.
Every trade outlet ran the same headline: AI replaces the UI. That is the least interesting thing about it. The interface was never the product you were paying for. It was the packaging. Strip it off and two things the packaging always hid come into full view: what the software actually costs you, and what it can actually be told to do. Both just changed, and neither change is what the keynote emphasized.
What Salesforce actually shipped
AIforce is not one thing. It bundles Claudeforce (a plug-in that lets Claude query records and take actions in Sales Cloud), Slackforce (the same from inside Slack), Agentforce Coworker (an agent that runs inside the old Lightning screens under a user’s existing permissions), and a Headless Toolkit for developers. The foundation underneath all of it, Headless 360, shipped quietly back in April at the TDX developer conference. It exposes the platform as an API, an MCP tool, or a CLI command, so agents running in Claude Code, Cursor, ChatGPT, Gemini, Codex, or Windsurf can operate the system through 60-plus MCP tools without a browser.
Salesforce also previewed Koa, its own CRM-specific reasoning model built on NVIDIA’s Nemotron family, which the company says “matches or exceeds leading model performance on CRM actions with 3x fewer errors,” according to the CX Foundation announcement roundup. Koa is in pilot with three customers, including Formula 1 and UChicago Medicine, and was trained without customer data.
That is the news. The analysis starts one layer down.
The interface was the packaging. The meter is the product.
A user interface is where a per-seat pricing model lives. You buy a login for each human, the human clicks around, and the bill scales with headcount. Remove the human from the loop and per-seat stops describing anything real. If an agent is doing the clicking, what exactly is a seat?
Salesforce’s answer is consumption pricing, and the numbers show how wide the spread now is. Forkast’s breakdown lays out four parallel buying routes: a basic tier at $5 per user per month, comprehensive editions starting at $550 per user, and a consumption path priced at $2 per conversation or $500 per 100,000 Flex Credits that sidesteps per-user fees entirely. For a 30-seat team, Forkast estimates first-year cost anywhere between $200,000 and $450,000 once you fold in the required editions, implementation, and credits. A Salesforce executive described the move as “a business model change and innovation for us” in VentureBeat’s account, which is candid: it is a change to how you are metered, not just what you buy.
This is the part that should worry a procurement lead more than the missing UI. A per-seat line is boring, and boring is forecastable. I have signed off on enough enterprise software renewals to know that finance can model headcount a year out and be roughly right. A per-conversation line cannot be modeled the same way, because usage is a function of how aggressively your agents run, and agents do not take lunch breaks. The buyer preference is already moving in that direction (Salesforce’s own keynote data, via G2, showed outcome-based pricing preference doubling from 11% to 23% year over year, with 70% of buyers demanding shorter contracts), but preference for outcome pricing is not the same as the ability to predict an outcome-priced bill. This is the same trap that turned cloud compute from a fixed asset into a variable one that surprises the CFO every quarter, and it is why the site has argued that the real discipline in enterprise AI is metering, not model choice. AIforce moves the meter to the middle of your workflow and asks you to trust that the number stays sane at volume.
Sixty tools, any agent, your keys
The second thing the UI was hiding is the permission surface. When work happened through a screen a human logged into, access control was a login problem. You knew who could see what, because you knew who had an account. Headless 360 turns every one of those capabilities into a tool that an authorized agent can call at runtime, from an environment Salesforce does not control.
The tell that this is a real risk, not a theoretical one, is that Salesforce shipped a defense for it at the same event. The company’s own IT announcement post describes MCP Security and Risk Scores, which scans servers during Agentforce registration for “prompt injections, tool poisoning, and rug pull attacks” and assigns each a Low, Medium, or High rating. Vendors do not build scanners for problems they do not have. An MCP surface that any agent can reach is an attack surface, and Salesforce is quietly conceding as much.
Anthropic’s reassurance, delivered on stage, is that the boundary holds: “Claude only sees what the person is allowed to see. Users authenticate with their own credentials,” said Anthropic’s head of enterprise products in the CX Foundation writeup. That is the correct design, and it is also exactly the sentence you want to verify rather than accept. The governance question has shifted from “who can log in” to “which agent, invoked by whom, can call which tool with which scope, and can I see it in a log afterward.” That is a harder question, and it is the one every practitioner who has read the recent AI coding-agent plugin exploits or watched a prompt injection walk through an AI browser should be asking. Treating a Salesforce MCP tool like a privileged service account, with a scoped, short-lived token and an audit trail, is not paranoia. It is the baseline you would apply to any other system that can now be driven by text from an untrusted source. If you are wiring this up, the MCP setup that survives production is the place to start.
Headless is not the same as portable
The word “headless” sounds like freedom. Your data, callable from anywhere, no lock-in to a vendor’s screens. The reality runs the other way. Jason Lemkin, who has been running his own company on agents for months, wrote in SaaStr that the announcement was less a product than “a description of what’s already happening,” and then landed the line that matters: “The agents chose the CRM. We didn’t.” Once your agents are wired into Salesforce’s MCP tools, switching means rebuilding the agent ecosystem that sits on top of them. The UI you were supposedly freed from was never the thing holding you in. The integration depth is, and headless makes it deeper.
There is a distribution angle too. Whoever’s agent becomes the front door (Claude, ChatGPT, whatever your people already have open) becomes the surface your CRM is experienced through, and the vendor that owns that surface owns the relationship. This is the same lesson the site drew from watching Google rent a thousand engineers to sit inside enterprises: the model was never the hard part, and neither is the database. The hard part, and the valuable part, is who controls the layer where work actually happens.
So evaluate AIforce as what it is, not as what the keynote called it. It is not a UI upgrade. It is a pricing change and a security change wearing a UI story. Two questions decide whether it is a good deal for you. What is my cost per agent action at the volume I will actually run, not the volume in the demo? And what is the exact scope of each tool an agent can invoke against my data, and can I prove it in a log? If your Salesforce rep can answer both cleanly, the disappearing interface is genuinely progress. If they can only talk about the interface, the two things it was hiding are still hiding, and now they are hiding behind an agent.