Customer Relationship Management (CRM) systems are widely used to manage interactions with customers and support core business operations such as sales, marketing, and customer service. Modern CRM platforms such as Salesforce and ServiceNow increasingly incorporate AI agents to automate tasks including lead qualification, customer communication, case handling, scheduling, reporting, and data maintenance.

These agents typically operate with access to sensitive data (e.g., customer records, financial transactions) and can execute high-stakes actions (e.g. sending customer-facing communications, updating records, initiating transactions). While operating in high-impact operational environments and interacting with external users, security enforcement around these automated workflows is often limited or inconsistent. This creates opportunities for third-party adversaries or malicious users to manipulate agents into performing harmful actions within the system. Such actions may include unauthorized access or modification of customer data, fraudulent financial operations, large-scale spam communications, or covert data exfiltration, leading to severe consequences including privacy violations, financial loss, regulatory risk, and reputational damage for organizations.

We first design a comprehensive set of benign tasks for CRM agents, covering 11 representative categories commonly encountered in real-world CRM workflows. Based on core CRM domain security policies from major platforms such as Salesforce and ServiceNow, as well as broader regulatory frameworks including the EU AI Act and GDPR, we derive a set of 9 key security risk categories. Guided by these risks, we construct red-teaming tasks with malicious goals under two primary threat models to systematically evaluate the security robustness of CRM agents.