AgentExchange Private Listings Now Require Security Review

Salesforce has tightened how apps are distributed on AgentExchange. As of August 12, 2026, customers cannot install or demo an app from a private or unpublished AgentExchange listing until that app has passed the Salesforce Security Review.

On listing pages for unreviewed solutions, the install and demo buttons are disabled.

If you already passed Security Review, nothing changes. If you have been using private listing URLs to get an unreviewed app into customer orgs, those installs are blocked until the review is approved.

What changed

AgentExchange Security Review requirements now apply regardless of listing type. Public, private, and unpublished listings are all held to the same bar: the app must pass Security Review before a customer can install or demo it.

That closes a common distribution path. Partners previously used private listing URLs to share apps with specific customers, run pilots, or let prospects try a solution before the full review was complete. Those URLs still work for preview and marketing, but they no longer unlock install or demo.

Why Salesforce is doing this

Salesforce’s stated goal is to make sure private listing URLs are only used to install apps that have already met AgentExchange Security Review requirements.

Private listings were never meant to be a way around review. They are meant for controlled distribution of solutions that have already been approved. This update aligns the install path with that intent, so customers are not installing unreviewed partner applications through a private URL.

What partners need to do

If your app has already passed Security Review, no action is needed. Your private listings continue to work as they do today, including install and demo.

If you are distributing an app that has not been reviewed, complete the Security Review in the Partner Console. Once the app is approved, install and demo buttons are enabled automatically. You do not need to republish the listing or send customers a new URL.

If review is still pending, you can keep sharing private listing URLs for preview or marketing. Customers will be able to view the listing, but they will not be able to demo or install the app until approval comes through.

Who this affects

This applies to partners distributing a Partner Application on AgentExchange through a private or unpublished listing.

You are in scope if any of the following is true:

• You share a private listing URL with specific customers or prospects
• You use unpublished listings for pilots, POCs, or limited rollouts
• Your app has not completed AgentExchange Security Review

You are not affected if the app has already passed Security Review, including apps that are only distributed privately after that approval.

This change also does not apply to packages created in Package Manager and shared with a direct install link. Those are a different distribution path from AgentExchange listings.

Package Manager install links are not in scope

Packages you build in Setup > Package Manager and share as a private install URL are not AgentExchange listings. Customers install them directly into the org through the packaging URL (typically /packaging/installPackage.apexp?p0=04t...), not from an AgentExchange listing page. There are no Install or Demo buttons to disable, so this August 12 change does not block those installs.

The distinction is the channel, not whether the package is private:

• Package Manager install link: Not affected. Direct packaging URLs continue to work as they do today.
• AgentExchange private or unpublished listing: Affected, if the app has not passed Security Review. Install and Demo stay disabled on the listing page until approval.

The same package can use both paths. If you share the Package Manager URL, installs keep working. If you wrap that package in an AgentExchange listing and customers install from the listing instead, Security Review is required before Install or Demo will work.

Practical impact

The change is already in effect. If a customer tries to install or demo from an unreviewed private listing today, the buttons on the listing page will be disabled.

Plan around that if you have active pilots or pending deals that depend on a private install:

1. Confirm the app’s Security Review status in the Partner Console.
2. If review is not complete, submit it (or finish an in-progress submission) before promising an install date.
3. Keep using the private URL for previews and conversations while review is pending, and set the expectation that install and demo stay locked until approval.
4. Once approved, tell customers they can use the same listing URL. The buttons enable automatically.

If you need help navigating Security Review or updating how you distribute on AgentExchange, get in touch.