Snowflake launches AI Gateway to secure autonomous agents amid rising security concerns

At Black Hat 2026, Snowflake introduced Cortex AI Gateway, a centralized control plane designed to govern the proliferating ecosystem of autonomous agents within enterprises. The gateway integrates Natoma, a MCP (Model Context Protocol) gateway that enforces identity, policy, and audit at the tool-call level. This addresses a critical pain point: as organizations rapidly adopt autonomous agents using standards like MCP to connect large language models (LLMs) to databases, internal tools, and SaaS environments, decentralized adoption has created unmanaged sprawl, fragmented user experiences, severe security liabilities, unvetted servers, tool hijacking risks, and data exfiltration threats.

Cortex AI Gateway operates across a wide spectrum of AI infrastructure. It governs first-party tools such as Snowflake CoCo and CoWork, as well as third-party ecosystems including Amazon Bedrock, Azure AI Foundry, ChatGPT, Claude Code, Cursor, and custom LangChain or LlamaIndex applications. Through Tools by Cortex AI Gateway, enterprises can enforce centralized governance over MCP tool usage, answering critical questions: who requested the action, what permissions do they have, and is the action allowed? The gateway delivers three core capabilities: Control—granting, restricting, and auditing model and tool access from a single endpoint with fine-grained authorization; Visibility—capturing agent actions in real time, including which tool was called, which system was touched, and in what order; and Cost and Performance—automatically routing requests to the right model based on cost, latency, capability, and data residency, while enforcing spending limits by team, agent, or workload.

The broader AI security foundation builds on this infrastructure. Agent Identity, now generally available, gives security and governance teams greater visibility into agent activity and enables enforcement of data access policies specific to agent sessions. Snowflake extended this framework to third-party agents through integrations with leading security vendors: 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint, and Saviynt. Restricted Session Scope, moving to GA soon, limits agent sessions to only the permissions required for their task—ensuring, for example, that a read-only analysis remains read-only even if the user's underlying role permits broader access.

These announcements arrive against a backdrop of accelerating enterprise AI risk. According to The Linux Foundation's 2026 State of Tech Talent Report, AI security concerns surged from 17% in 2024 to 48% in 2026. While 97% of organizations are committed to implementing AI, 57% face a significant capacity gap in security and risk management. Autonomous agents have dramatically expanded the enterprise attack surface by combining data access, system execution, and data movement into single profiles. Legacy monitoring tools and patchwork application-layer fixes no longer suffice.

Snowflake moved several features to general availability: Native AI Security Posture Management, which integrates into the Snowflake Trust Center to proactively scan for AI-specific risks and deploy programmatic remediations; and Ransomware Protection via Multi-Party Approval, which requires two or more authorizations before destructive system changes can proceed, eliminating single points of failure even if top-tier administrative credentials are compromised. Additional capabilities entered private preview: Wide Model Catalog (bringing GPT, Gemini, Claude, Grok, Mistral, GLM and more under one roof while respecting data residency requirements); Access Governance and Sprawl Control; Govern Every Agent Connection (100+ MCP servers, including bring-your-own and VPC connect); Observability and Tracing (capturing agent tool calls securely in real time for audit trails); Agent Action Auditability; AI Cost Control (unified consumption views and budget guardrails); Intelligent Model Routing (automatic routing based on cost, latency, capability, and data residency); Context-Aware Access Policies (zero-trust controls evaluating identity, network, and client context jointly); Advanced Data Exfiltration Prevention (pairing real-time telemetry with strict data movement policies to detect and intercept unauthorized data flows, sensitive data fetches triggered by AI agents, unauthorized routing to stages, and mass downloads); and Client-side CoCo CLI VM Sandbox (currently on macOS, isolating each CoCo session in a separate Linux kernel).

Snowflake is demonstrating Cortex AI Gateway and AI Agent Identity controls at Black Hat USA 2026, booth #8206, and inviting security and compliance professionals to discuss further details with product team members. The company framed these announcements as foundational to what it calls the "agentic enterprise"—an environment where security is built directly into the data and control planes, enabling organizations to innovate without compromise as they move from prototype to production deployment of AI agents.

The jump in AI security concerns from 17% in 2024 to 48% in 2026 signals a fundamental shift in enterprise priorities. While 97% of organizations are committed to implementing AI, the 57% facing a significant capacity gap in security and risk management reveals a dangerous mismatch between ambition and preparedness. Autonomous agents have become the focal point of this tension: they combine data access, system execution, and data movement into single profiles that vastly expand the attack surface, yet many organizations rely on fragmented, application-layer fixes and legacy monitoring tools that cannot keep pace.

Snowflake's announcement addresses this structural vulnerability directly. By embedding Natoma—a centralized MCP gateway—into its ecosystem, the company is attempting to enforce identity, policy, and audit at the tool-call level, thereby converting a decentralized, unmanaged sprawl into a unified control plane. The breadth of third-party integrations (1Password, Aembit, Cyera, Linx Security, Okta, SailPoint, Saviynt) and platform support (Amazon Bedrock, Azure AI Foundry, ChatGPT, Claude Code, Cursor, custom frameworks) signals that Snowflake sees the security problem as industry-wide and requiring interoperability, not proprietary lock-in.

The security features moving to GA—Agent Identity, Restricted Session Scope, Native AI Security Posture Management, and Ransomware Protection via Multi-Party Approval—indicate that Snowflake views agent identity governance and zero-trust principles as production-grade necessities. The private-preview Data Exfiltration Prevention and CoCo CLI VM Sandbox underscore a defense-in-depth philosophy: security controls are layered across identity, network, data movement, and workload isolation, rather than concentrated at any single point.

No comments yet. Be the first to share your thoughts!