Snowflake Launches AI Gateway, Security Stack for Enterprise Agents

At Black Hat 2026, Snowflake announced two complementary product initiatives: the Cortex AI Gateway, a new centralized governance and interoperability layer for autonomous agents, and a suite of production-grade AI security features.

The Cortex AI Gateway addresses a core operational problem: as enterprises deploy autonomous agents across multiple LLM providers and internal tools, they lose visibility and control. Agents using standards like the Model Context Protocol (MCP) can connect to databases, internal tools and SaaS environments, but decentralized adoption creates unmanaged sprawl, fractured user experiences, and security liabilities including unvetted servers, tool hijacking and data exfiltration. By integrating Natoma—a centralized MCP gateway that enforces identity, policy and audit at the tool-call level—into Snowflake, the company provides what it calls "the connective layer for all trusted agent activity."

Cortex AI Gateway governs how agents from both first-party sources (Snowflake's own CoCo and CoWork) and third-party ecosystems (Amazon Bedrock, Azure AI Foundry, ChatGPT, Claude Code, Cursor, and custom LangChain or LlamaIndex applications) access models, data, MCP servers and enterprise tools. The platform delivers three operational capabilities: Control (grant, restrict and audit model and tool access from a single endpoint with fine-grained authorization); Visibility (capture agent actions in real time—which tool was called, which system it touched, in what order and by whom—and provide audit trails); and Cost and Performance (automatically route requests to the right model based on cost, latency, capability and data residency requirements, and enforce spending limits by team, agent or workload).

Key features rolling out include Wide Model Catalog (private preview) to consolidate GPT, Gemini, Claude, Grok, Mistral, GLM and others in a single governance layer; Access Governance and Sprawl Control (private preview) to reduce manual configuration for dozens of emerging agent types; Govern Every Agent Connection (private preview) covering 100+ MCP servers; Observability and Tracing (private preview) for real-time capture of agent tool calls; and AI Cost Control and Intelligent Model Routing (both private preview) for budget enforcement and automatic model selection.

Snowflake is transitioning a set of native security capabilities to production. Agent Identity (GA) gives security teams visibility into agent activity and lets them enforce data access policies that apply specifically when an agent is in a session, with dedicated agent identity tracking in Account Usage views. The company is extending these frameworks to third-party agents through integrations with 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint and Saviynt. Restricted Session Scope (GA soon) limits what an agent session can do to only what the task requires. Context-Aware Access Policies (private preview) allow security admins to author a single zero-trust policy that evaluates identity, network and client context jointly.

For proactive risk management, Snowflake has moved Native AI Security Posture Management to GA, integrating AI-specific risk scanning into the Trust Center with a comprehensive dashboard and programmatic remediations for misconfigurations. Advanced Data Exfiltration Prevention (preview) pairs real-time telemetry with strict data movement policies (GA) to detect and intercept unauthorized data flows—including sensitive data fetches triggered by AI agents, unauthorized data routing to internal or external stages, and mass data downloads via user interfaces. Client-side CoCo CLI VM Sandbox (private preview) runs AI-assisted development workflows in isolated Linux kernels, available as an admin-enforced or self-managed control on macOS. Ransomware Protection via Multi-Party Approval (MPA) is now GA, requiring two or more authorizations before destructive system changes can proceed.

Snowflake framed these announcements against industry context: according to The Linux Foundation's 2026 State of Tech Talent Report, AI security concerns have surged from 17% in 2024 to 48% in 2026. While 97% of organizations are committed to implementing AI, 57% face a significant capacity gap in security and risk management. The company positioned security as foundational to the agentic enterprise, arguing that it must be built directly into the data and control planes rather than addressed through a patchwork of application-layer fixes and legacy monitoring tools.