Snowflake launches AI security suite, gateway for autonomous agents

At Black Hat USA 2026, Snowflake unveiled a comprehensive security and governance platform designed to address the rapid expansion of autonomous agents in enterprise environments. The announcement centers on two major components: Cortex AI Gateway and a suite of production-grade AI security capabilities.

Cortex AI Gateway functions as a centralized control layer for agent interoperability. It integrates Natoma, described as a centralized MCP gateway, to enforce identity, policy and audit at the tool-call level across both Snowflake's native tools (CoCo and CoWork) and third-party ecosystems including Amazon Bedrock, Azure AI Foundry, ChatGPT, Claude Code, Cursor, custom LangChain and LlamaIndex applications, and others. The gateway governs access to a wide catalog of models including GPT, Gemini, Claude, Grok, Mistral and GLM. Key features include a Wide Model Catalog (private preview) allowing enterprises to run models in their own geography for data residency compliance; Access Governance and Sprawl Control (private preview) to reduce manual configuration of agent connections; and Govern Every Agent Connection (private preview), which supports discovery and monitoring of 100+ MCP servers with automatic detection of shadow AI.

On the visibility side, Cortex AI Gateway offers Observability and Tracing (private preview) to capture agent tool calls in real time for audit trails, and Agent Action Auditability (private preview) to provide end-to-end records of which systems an agent touched and in what sequence. For cost management, the platform features AI Cost Control (private preview) with unified consumption views by team, agent or workload, and Intelligent Model Routing (private preview) to automatically route requests based on cost, latency, capability and data residency, including prompt management.

Parallel to the Gateway, Snowflake transitioned several security capabilities to general availability and preview status. Agent Identity (GA) gives security teams visibility into agent activity and allows enforcement of data access policies that apply when an agent operates on behalf of a privileged user, with dedicated agent identity tracking in Account Usage views. Third-Party Agent Identity extends governance to external AI tools through integrations with security providers including 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint and Saviynt. Restricted Session Scope (GA soon) limits agent sessions to only the permissions required for their task, preventing read-only analysis sessions from escalating privileges. Context-Aware Access Policies (private preview) apply zero-trust evaluation of identity, network and client context in a single expression.

Snowflake also advanced its security posture capabilities. Native AI Security Posture Management (GA) is now integrated into the Snowflake Trust Center, providing a comprehensive dashboard for security operations teams to scan for AI-specific configuration risks, assess compliance against emerging global regulations and deploy programmatic remediations. For data protection, the company launched its Data Exfiltration Prevention (DXP) package in preview, pairing real-time telemetry with strict data movement policies to detect and intercept unauthorized data flows, including sensitive data fetches triggered by AI agents, unauthorized data routing to internal or external stages, and mass downloads via user interfaces. The Client-side CoCo CLI VM Sandbox (private preview, currently macOS) isolates each CoCo development session in a separate Linux kernel, shielding credentials and local storage from client-side AI workloads. Ransomware Protection via Multi-Party Approval (MPA) reached GA status, requiring two or more authorizations before any destructive system change can proceed to prevent unilateral data wipe or configuration alteration even if top-tier administrative credentials are compromised.

The context for this release is urgent. According to The Linux Foundation's 2026 State of Tech Talent Report, AI security concerns have surged from 17% in 2024 to 48% in 2026. While 97% of organizations are committed to implementing AI, 57% face a significant capacity gap in security and risk management. The underlying problem is structural: autonomous agents have dramatically expanded the enterprise attack surface by combining data access, system execution and data movement into a single workflow, and traditional application-layer fixes and legacy monitoring are insufficient. Snowflake's framing emphasizes that security must be built directly into the data and control planes rather than applied as an external wrapper.