Snowflake launches AI security tools as agent threats surge from 17% to 48%

Snowflake announced Cortex AI Gateway and a suite of production-grade AI security advancements at Black Hat 2026, directly responding to a documented shift in enterprise risk perception. According to The Linux Foundation's 2026 State of Tech Talent Report, AI security concerns have surged from 17% in 2024 to 48% in 2026—a critical jump given that while 97% of organizations are committed to implementing AI, 57% face a significant capacity gap in security and risk management.

The core challenge, as Snowflake frames it, is that autonomous agents have dramatically expanded the enterprise attack surface by combining data access, system execution and data movement into a single profile. The body notes that teams are rapidly adopting standards like MCP (Model Context Protocol) to connect LLMs to databases, internal tools and SaaS environments, but decentralized adoption creates unmanaged sprawl, fractured user experiences, security liabilities including unvetted servers and tool hijacking, and visibility gaps into agent behavior. Cortex AI Gateway addresses this by integrating Natoma—a centralized MCP gateway that enforces identity, policy and audit at the tool-call level—into the Snowflake ecosystem. The gateway acts as a connective layer for all trusted agent activity, governing how both first-party agents (Snowflake CoCo and CoWork) and third-party ecosystems (Amazon Bedrock, Azure AI Foundry, ChatGPT, Claude Code, Cursor, custom LangChain or LlamaIndex apps and others) access models, data, MCP servers and enterprise tools.

Cortex AI Gateway delivers three primary value drivers. Control capabilities enable teams to grant, restrict and audit model and tool access from a single endpoint with fine-grained authorization, replacing manual configuration for each new agent type; a Wide Model Catalog in private preview allows enterprises to bring models like GPT, Gemini, Claude, Grok, Mistral and GLM under one roof and run them in their chosen geography; Access Governance and Sprawl Control in private preview reduces the need for manual connections and allows teams to govern MCP tool usage across 100+ MCP servers (including bring-your-own and VPC connect). Visibility capabilities ensure agent actions are captured in real time—which tool was called, which system it touched, in what order and by whom—providing audit trails for security and compliance without instrumenting each agent individually; Observability and Tracing (private preview) securely captures agent tool calls for usage tracking, troubleshooting and forensics, while Agent Action Auditability provides an end-to-end record of agent activity. Cost and performance controls route requests automatically to the right model based on cost, latency, capability and data residency; AI Cost Control (private preview) offers unified visibility into consumption by team, agent or workload and enforces budget guardrails, while Intelligent Model Routing automatically selects models to optimize output without overpaying or misrouting sensitive data.

Complementing the gateway, Snowflake is advancing its native AI security stack. Agent Identity is moving to general availability, giving security teams greater visibility into agent activity and enabling data access policies that apply specifically during agent sessions; Third-Party Agent Identity extends these frameworks to external tools through integrations with 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint and Saviynt. Restricted Session Scope is coming soon to GA, limiting agent sessions to only the permissions required for their task. Context-Aware Access Policies (private preview) provide zero-trust controls allowing security admins to author a single policy evaluating identity, network and client context jointly. Native AI Security Posture Management is now GA, fully integrated into the Snowflake Trust Center with a comprehensive dashboard to scan for AI-specific risks and assess compliance against emerging regulations. Advanced Data Exfiltration Prevention is launching in preview, pairing real-time telemetry with strict data movement policies (GA) to detect and intercept unauthorized data flows including sensitive data fetches triggered by AI agents, unauthorized data routing to stages, and mass downloads. Client-side CoCo CLI VM Sandbox (private preview) isolates each session in a separate Linux kernel, minimizing exposure of credentials and local storage to client-side AI workloads, currently available on macOS as an admin-enforced or self-managed control. Ransomware Protection via Multi-Party Approval is now GA, requiring two or more authorizations before destructive system changes, eliminating single points of failure even if top-tier administrative credentials are compromised.