Snowflake launches AI Gateway to govern autonomous agent sprawl

At Black Hat 2026, Snowflake unveiled Cortex AI Gateway, a new infrastructure layer designed to centralize governance of autonomous agents across enterprise systems. The gateway integrates Natoma, a centralized MCP gateway that enforces identity, policy and audit at the tool-call level, into the Snowflake ecosystem. This allows enterprises to govern how AI agents—both Snowflake-native tools like CoCo and CoWork, as well as third-party platforms such as Amazon Bedrock, Azure AI Foundry, ChatGPT, Claude Code, Cursor, and custom LangChain or LlamaIndex applications—access models, data, MCP servers and enterprise tools.

The core problem Cortex AI Gateway solves is fragmentation. As enterprises scale autonomous agents across multiple models, tools and platforms, they encounter three overlapping challenges: fragmented access with no centralized control, lack of visibility into what agents are doing, and AI costs spiraling out of control. The gateway addresses these by providing three capabilities. Control allows teams to grant, restrict and audit model and tool access from a single endpoint, replacing manual configuration for each new agent type with centralized fine-grained authorization. Visibility captures agent actions in real time—which tool was called, which system it touched, and in what order—and creates audit trails for security and compliance teams without requiring instrumentation of each agent individually. Cost and Performance includes automatic model routing based on cost, latency, capability and data residency requirements, and enforces spending limits by team, agent or workload to prevent costs from accelerating unchecked.

The announcement also reflects the rapidly shifting landscape of AI security. According to The Linux Foundation's 2026 State of Tech Talent Report, AI security concerns have surged from 17% in 2024 to 48% in 2026. Although 97% of organizations are committed to implementing AI, 57% face a significant capacity gap in security and risk management. Autonomous agents are expanding the enterprise attack surface by consolidating data access, system execution and data movement; a patchwork of application-layer fixes and legacy monitoring tools is insufficient. Complementing the Cortex AI Gateway, Snowflake is transitioning several native security capabilities to general availability or public preview. Agent Identity (GA) gives security teams visibility into agent activity and enables data access policies that apply specifically when an agent is in the session. Restricted Session Scope (GA soon) limits what an agent session can do to only what the task requires. Native AI Security Posture Management (GA) provides a comprehensive dashboard in the Snowflake Trust Center to proactively scan for AI-specific risks and deploy programmatic remediations. Ransomware Protection via Multi-Party Approval is now GA, requiring two or more authorizations before any destructive system change can proceed. Advanced Data Exfiltration Prevention (preview) pairs real-time telemetry with strict data movement policies to detect and intercept unauthorized data flows, proactively flagging sensitive data fetches triggered by AI agents, unauthorized data routing to internal or external stages, and mass data downloads. In private preview are a Wide Model Catalog (bringing GPT, Gemini, Claude, Grok, Mistral and GLM under one roof), Access Governance and Sprawl Control, Observability and Tracing, AI Cost Control, Intelligent Model Routing, Context-Aware Access Policies, and Client-side CoCo CLI VM Sandbox (which runs AI-assisted development workflows in an isolated Linux kernel on macOS).

Snowflake is demonstrating these capabilities at Black Hat USA 2026, booth #8206, showcasing the Cortex AI Gateway, AI Agent Identity controls and automated threat scanners in the Snowflake Trust Center. The company frames the challenge as one of embedding security directly into the core data and AI infrastructure, allowing organizations to move confidently from prototype to production while deploying autonomous agents inside the secure enterprise.