Snowflake launches AI Gateway, security tools for autonomous agents

At Black Hat USA 2026, Snowflake addressed one of the most pressing enterprise challenges: securing autonomous agents at scale. The announcement came against a backdrop of surging security concerns—AI security worries among tech professionals jumped from 17% in 2024 to 48% in 2026, according to The Linux Foundation's 2026 State of Tech Talent Report. While 97% of organizations remain committed to implementing AI, 57% face a significant capacity gap in security and risk management.

The core announcement was Cortex AI Gateway, a centralized control layer for managing how AI agents interact with enterprise systems. The gateway integrates Natoma, an MCP (Model Context Protocol) gateway, to enforce identity, policy, and audit at the tool-call level. The problem it solves is acute: as enterprises scale autonomous agents across multiple models and platforms—including ChatGPT, Claude Code, Azure AI Foundry, Amazon Bedrock, custom LangChain or LlamaIndex applications, and Snowflake's own CoCo and CoWork—decentralized adoption creates unmanaged sprawl, fractured user experiences, and severe security liabilities. Agents can become vulnerable to unvetted servers, tool hijacking, and data exfiltration; simultaneously, organizations lose visibility into agent activity and AI costs spiral out of control.

Cortex AI Gateway delivers three categories of capability. First, Control: enterprises can grant, restrict, and audit model and tool access from a single endpoint, managing permissions centrally with fine-grained authorization instead of manually configuring each agent type. Features in private preview include a Wide Model Catalog (supporting GPT, Gemini, Claude, Grok, Mistral, GLM and others) to run models in users' chosen geography, Access Governance and Sprawl Control to manage tool access across 100+ MCP servers, and the ability to govern every agent connection with streamlined policies, authentication, and fine-grained authorization. Second, Visibility: agent actions are captured in real time—which tool was called, which system it touched, in what order, and by whom. Private preview features include Observability and Tracing to capture agent tool calls securely with comprehensive audit trails, and Agent Action Auditability to provide end-to-end records of agent actions and the systems they touched. Third, Cost and Performance: requests are automatically routed to the right model based on cost, latency, capability, and other requirements, with spending limits enforced by team, agent, or workload. AI Cost Control (in private preview) provides a unified view of AI consumption and automatic model routing based on cost, latency, capability, and data residency.

Snowflake simultaneously transitioned a suite of native security capabilities to general availability and public preview. Agent Identity moved to GA, giving security teams greater visibility into agent activity and the ability to enforce data access policies specific to agent sessions; the company extended this to third-party agents through integrations with 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint, and Saviynt. Restricted Session Scope—limiting what an agent session can do to only what the task requires—is coming to GA soon. In private preview, Context-Aware Access Policies enable security admins to author a single policy that evaluates identity, network, and client context jointly.

On the proactive side, Native AI Security Posture Management moved to GA, integrating directly into the Snowflake Trust Center to scan for AI-specific risks and assess compliance postures against emerging global regulations. Snowflake launched its Data Exfiltration Prevention (DXP) package into preview via the Trust Center; by pairing real-time telemetry with strict data movement policies (now GA), the platform detects and intercepts unauthorized data flows—including sensitive data fetches triggered by AI agents, unauthorized data routing to internal or external stages, and mass data downloads via user interfaces. A Client-side CoCo CLI VM Sandbox (in private preview) isolates each CoCo session in a separate Linux kernel, shielding credentials, local storage, and networks from client-side AI workloads on macOS. Finally, Ransomware Protection via Multi-Party Approval reached GA, requiring two or more authorizations before any destructive system change can proceed, preventing single points of failure even if top-tier administrative credentials are compromised.

Snowflake invited attendees to booth #8206 at Black Hat USA 2026 to see demonstrations of Cortex AI Gateway, Agent Identity controls, and the automated threat scanners in the Snowflake Trust Center. The company framed the announcement as foundational to securing what it called the "agentic enterprise"—one where security is built directly into the data and control planes, allowing teams to move confidently from prototype to production with AI agents deployed inside the secure enterprise.