Every autonomous outbound tool before this one worked in task-sized units. You approved a sequence, it sent the sequence, and the blast radius of a bad decision was one send window. AI SDR agents built to pursue a goal for weeks break that arrangement, and the industry is discussing the wrong half of it.
Salesforce announced a long-horizon runtime at Dreamforce 2026 and made Hunter, its outbound sales agent, the first agent to run on it. The runtime has three named parts: memory across sessions, durable execution so a plan survives beyond one conversation, and dynamic steering so the agent updates its own configuration from feedback. Salesforce describes the point of it plainly in its own write-up of long-horizon agents: goals that take days and weeks, not chat turns.
Hunter sits on it as the outbound counterpart to Piper, which already handles inbound. Salesforce describes Hunter as working a pipeline from research through outreach, collaborating with sellers over weeks and months. Its agent portfolio announcement from September 11 lists seven named agents, and Hunter is the one still in pilot while the Agentforce page carries a general availability target of November 2026.
Most of the commentary has gone to whether an agent can write a decent first line. That question was settled months ago and the answer was boring: yes, roughly as well as a tired human, and copy quality was never the binding constraint anyway. We argued that when the data showed cadence outperforming copy on AI-run outbound, and nothing since has changed it.
The new variable is time. An agent with a six week goal, persistent memory and the ability to adjust its own plan is not a faster sequence tool. It is a thing that holds an objective longer than most quarterly reviews, on infrastructure you are responsible for.
What Changed When AI SDR Agents Got A Long Horizon
AI SDR agents moved from executing a defined sequence to holding a business objective across sessions, which means the unit of human review changed from the message to the mandate. Salesforce names three capabilities that make this possible, and each one removes a natural checkpoint that used to exist by accident.
Memory across sessions is the one that matters most and gets discussed least. A sequence tool forgets. Every run starts from the list and the template, so a mistake in week one does not compound into week five. An agent that remembers what it tried, what bounced and what a prospect said in a reply carries its own assumptions forward, including the wrong ones.
Durable execution removes the second checkpoint. A plan that persists beyond one session does not come back for re-authorization when someone logs in on Monday. It simply continues, which is the entire product promise and also the thing that should make a revenue operations lead sit up.
Dynamic steering is the genuinely new capability, and Salesforce has been careful with it. The agent updates its configuration from feedback, and when the resulting behaviour would deviate from the approved plan it prompts for approval first. In the deal-rescue example Salesforce uses, an outreach email bounces and the agent asks before sending a replacement that departs from what was agreed.
Why Duration Is The Part Nobody Priced
The approval gate fires on deviation from an approved plan, which means everything the agent does inside that plan proceeds without a prompt, and the specificity of the plan therefore sets the width of the autonomy. This is the inversion most buying committees have not worked through yet.
“An agent that deviates from the approved plan stops and asks. Read that twice, because the sentence is doing far more work than it looks.”
Consider two plans for the same goal. Plan A says: book qualified meetings with security leaders at companies between 500 and 5,000 employees. Plan B says the same thing, then adds a ceiling of two sending domains, a maximum of four touches per contact across 30 days, no new domain introduced without sign-off, hard stop on any list where the bounce rate passes two percent, and a weekly summary of everything sent. Both are approved plans. Plan A authorizes six weeks of unreviewed sending. Plan B authorizes a narrow, measurable campaign that will trip a gate the moment it strays.
Nothing in the product distinguishes them. The gate does its job identically in both cases. The difference is entirely in the quality of the thinking that went into the plan on day one, which is a governance problem dressed as a configuration screen.
| AGENT BEHAVIOUR DURING A SIX WEEK GOAL | INSIDE AN APPROVED PLAN? | DOES A GATE FIRE? | WHAT YOU SHOULD PRE-DECIDE |
|---|---|---|---|
| Researching 400 more accounts that fit the stated profile | Yes, if the profile is broad | No | A hard account ceiling per period, not just a profile |
| Adding a third sending domain to raise capacity | Depends entirely on plan wording | Only if the plan names domains | Name the domains. Treat a new one as a deviation |
| Increasing touches from three to six after weak reply rates | Usually yes, cadence is rarely specified | No | A touch ceiling per contact and per period |
| Emailing a contact who replied with a soft no | Often yes, a soft no is not an opt out | No | Explicit suppression rules for ambiguous replies |
| Rewriting the offer after a bounce, departing from the plan | No | Yes, this is the documented case | Who holds approval authority and their response time |
| Continuing to send while the bounce rate climbs | Yes, unless a threshold is written in | No | Numeric stop conditions tied to deliverability metrics |
Look down the third column. One gate fires out of six plausible behaviours, and it is the one where the agent is behaving most carefully. The five silent rows are not product defects. They are the predictable result of approving an objective instead of a constraint set, and every one of them is fixable in the plan before anybody switches it on.
What AI SDR Agents Do To A Sending Domain Over Six Weeks
A long-horizon outbound agent accumulates sending reputation consequences on domains that outlive the campaign, so the cost of a badly scoped plan is not a wasted quarter of pipeline but a set of burned domains you have to replace and warm again. This is where the duration question stops being philosophical.
The mechanics have not changed just because the sender is now an agent. Volume ramps still matter, bounce rates still compound, and the thresholds teams believe in are mostly folklore, which we went through when we looked at the sending domain thresholds practitioners quote without checking. What changes is who is making the ramp decisions and how often anyone looks.
Where we would place the gates first on a long-horizon outbound agent, ranked by how much damage the unguarded version does. Our recommended priority, not measured data
Copy review sits at the bottom deliberately. It is the thing teams instinctively want to control and the thing that matters least to whether your infrastructure survives the engagement. We made the same argument about reputation when AI-written outbound started showing up in sender reputation data, and the ranking has only hardened since.
There is an honest counterargument worth stating. An agent with persistent memory could plausibly manage deliverability better than a human sales development representative juggling six other tasks, because it can watch bounce signals continuously rather than at the weekly pipeline meeting. That is a real possibility and the early pilot claims gesture at it. Coverage of Hunter's pilot reports that one customer, Perk, built around 60 percent of its pipeline with the agent, which is a single pilot result and not a benchmark, as the people reporting it have been careful to note.
We looked hard at a similar promise before, when autonomous agents were being sold as self-correcting in the reality check we ran on the autonomous sales development category. The pattern then was that the self-correction worked on the metrics the vendor instrumented and was blind to the ones it did not. Deliverability has historically been in the second group, because the signals live with the mailbox provider rather than in the sending tool.
How To Write An Approval That Actually Constrains
A plan that constrains an agent reads like a contract rather than a brief: numeric ceilings, named resources, explicit stop conditions and a single person who holds approval authority with a stated response time. The objective goes in one line and the constraints take the rest of the page.
None of this is exotic. It is the same discipline a competent agency applies to a managed sending programme, written down in a place the software reads. The reason it feels unfamiliar is that the previous generation of tooling enforced review through its own limitations, and those limitations are what just went away.
What Should You Do Before The GA Switch Flips?
Before general availability reaches your org, decide three things: which domains an agent may ever send from, who holds approval authority on deviations, and what numeric conditions pause a goal outright. Those three decisions take an afternoon and they are considerably harder to make retroactively.
The timing is unusually legible, which is a gift. Salesforce lists Hunter as pilot with a November 2026 general availability target on its Agentforce page, while a Sales Cloud release page describes it as generally available this fall inside Coworker. Those two statements are close but not identical, so the practical read is that access is arriving now in some orgs and shortly in others. Either way the window for deciding policy before somebody enables it is measured in weeks.
This is not an argument against agentic outbound. The runtime design is sound, the approval-on-deviation gate is genuinely more control than the sequence tools it replaces, and for B2B SaaS teams running thin development capacity the economics are obvious. The argument is narrower: the control surface Salesforce built only does work if the plan it compares against is specific, and nothing in the product will tell you that your plan is too vague.
Expect the first wave of bad outcomes to look like mysteries rather than failures. Reply rates that sag in week four for no visible reason. A domain that stops landing. An account that got touched eleven times by an agent faithfully executing an objective nobody re-read after the day it was approved. In each case the logs will show a system working exactly as instructed, which is the least satisfying kind of incident review there is.
The teams who handle the next two quarters well will not be the ones with the best prompts. They will be the ones who treated plan approval as the governance event it actually is, and who wrote down the numbers before the software asked for them.
See where you are cited today
A free snapshot audit of your rankings and AI citations before we ever talk.
Tyler leads work at the intersection of SEO and generative engines at Something Inc., helping B2B brands get ranked and cited across every major AI engine.