Snowflake launches AI Gateway and security stack for autonomous agents

At Black Hat USA 2026, Snowflake is addressing a critical inflection point in enterprise AI security. According to The Linux Foundation's 2026 State of Tech Talent Report, AI security concerns have surged from 17% in 2024 to 48% in 2026—a near tripling of anxiety—even as 97% of organizations remain committed to implementing AI. The paradox is stark: while adoption intent is near-universal, 57% of organizations face a significant capacity gap in security and risk management, creating a vulnerability window as autonomous agents proliferate.

The core announcement is Cortex AI Gateway, which integrates Natoma—a centralized Model Context Protocol (MCP) gateway—directly into Snowflake's ecosystem. The Gateway enforces identity, policy, and audit controls at the tool-call level, creating a single governance layer for all trusted agent activity. Unlike decentralized deployments where teams quickly connect LLMs to databases and internal tools via MCP standards, the Gateway consolidates control: enterprises can now govern first-party tools (like Snowflake's own CoCo and CoWork) and third-party agents (from Amazon Bedrock, Azure AI Foundry, ChatGPT, Claude Code, Cursor, custom LangChain or LlamaIndex apps, and others) from a single endpoint. This addresses the core pain points of autonomous agent deployment—unmanaged sprawl, fractured user experiences, unvetted servers, tool hijacking, data exfiltration, lack of visibility into agent actions, and spiraling AI costs.

Cortex AI Gateway delivers three capabilities. First, Control: teams can grant, restrict, and audit model and tool access centrally with fine-grained authorization, eliminating the need to manually configure each new agent type. In private preview, Access Governance and Sprawl Control reduces administrator overhead by allowing teams to manage permissions across 100+ MCP servers (including bring-your-own and VPC-connected servers), with automatic discovery and monitoring of shadow AI. Second, Visibility: Agent actions are captured in real time—which tool was called, which system it touched, and in what order—providing audit trails without requiring individual agent instrumentation. In private preview, Observability and Tracing securely captures agent tool calls in real time for usage tracking, troubleshooting, and forensics, while Agent Action Auditability delivers end-to-end records of agent actions and the systems they touched. Third, Cost and Performance: the Gateway automatically routes requests to the right model based on cost, latency, capability, and data residency requirements, enforcing spending limits by team, agent, or workload. In private preview, AI Cost Control provides a unified view of AI consumption and applies budget guardrails, while Intelligent Model Routing automatically routes agent requests to cheaper models for simpler tasks without sacrificing quality and includes prompt management.

Complementing the Gateway, Snowflake is transitioning a suite of native, enterprise-grade security capabilities to production. Agent Identity is now generally available, giving security teams visibility into agent activity and the ability to enforce data access policies that apply specifically when an agent is in the session, even if it runs on behalf of a privileged user; dedicated agent identity tracking is also added to Account Usage views for auditing. Third-Party Agent Identity extends these controls to external AI tools through integrations with security providers including 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint, and Saviynt. Restricted Session Scope, coming to GA soon, limits what an agent session can do to only what the task requires—for example, keeping a read-only analysis read-only even if the user's role normally permits more. In private preview, Context-Aware Access Policies is a zero-trust control allowing security admins to author a single policy that evaluates identity, network, and client context jointly.

For proactive security posture management, Native AI Security Posture Management is now generally available, integrating into the Snowflake Trust Center with a comprehensive dashboard to scan for AI-specific risks, assess compliance postures against emerging global regulations, and deploy programmatic remediations. For zero-trust data protection, Snowflake has launched its Data Exfiltration Prevention (DXP) package into preview via the Trust Center, pairing real-time telemetry with strict data movement policies (GA) to detect and intercept unauthorized data flows before they exit the ecosystem, flagging and blocking sensitive data fetches triggered by AI agents, unauthorized data routing to internal or external stages, and mass data downloads via user interfaces. In private preview, Client-side CoCo CLI VM Sandbox allows developers to run AI-assisted workflows while isolating credentials, local storage, and networks from client-side AI workloads by running each CoCo session in a separate Linux kernel, isolated from the host operating system; the feature is currently available on macOS as either an admin-enforced or self-managed control. Finally, Ransomware Protection via Multi-Party Approval is now generally available, requiring two or more authorizations before any destructive system change can proceed, eliminating single points of failure even if top-tier administrative credentials are compromised.

Snowflake's strategy is to embed security directly into the data and control planes rather than relying on application-layer fixes and legacy monitoring tools. The company is positioning itself as a platform where enterprises can innovate without compromise, moving confidently from prototype to production while deploying AI agents securely inside the enterprise. Demonstrations of Cortex AI Gateway, AI Agent Identity controls, and automated threat scanners are available at Snowflake booth #8206 at Black Hat USA 2026.

The jump in AI security concerns—from 17% to 48% in two years—reflects a structural shift in enterprise risk. As organizations rapidly deploy autonomous agents, the attack surface has grown dramatically: agents now combine data access, system execution, and data movement into single profiles, creating what Snowflake calls a critical capacity gap between AI adoption intent (97% of organizations) and security readiness (only 43% feel equipped in security and risk management). The core problem Snowflake is addressing is decentralized sprawl: as teams connect large language models to databases and tools via standards like MCP, each connection becomes an unvetted security liability, visibility disappears, and costs spiral. Snowflake's response—embedding governance directly into the data and control planes rather than layering it on top—reflects a broader industry recognition that patchwork application-layer fixes and legacy monitoring tools are insufficient for agentic systems.

The Cortex AI Gateway's architecture aims to unify three previously fragmented concerns: tool access control (which agents can call which systems), visibility (real-time audit trails of agent actions), and cost management (automatic routing to cheaper models for simple tasks). By integrating Natoma and extending Snowflake's existing data governance framework to agent traffic, the gateway also positions Snowflake to support a multi-model, multi-platform future—enterprises can run GPT, Gemini, Claude, Grok, Mistral, GLM, and others within their own regions, addressing data residency and compliance constraints. The shift of features like Agent Identity and Ransomware Protection via Multi-Party Approval to GA signals that Snowflake views these as production-ready, while numerous capabilities remain in private preview (Intelligent Model Routing, Advanced Data Exfiltration Prevention, Context-Aware Access Policies), indicating that full production readiness across the stack is still maturing.

No comments yet. Be the first to share your thoughts!