Snowflake launches Cortex AI Gateway, beefs up AI security at Black Hat 2026

At Black Hat 2026, Snowflake unveiled Cortex AI Gateway and a production-grade AI security stack designed to address a fundamental shift in enterprise risk. The Linux Foundation's 2026 State of Tech Talent Report documents the urgency: AI security concerns have surged from 17% in 2024 to 48% in 2026, yet 57% of organizations report a significant capacity gap in security and risk management even as 97% commit to AI adoption. Autonomous agents have made this gap acute by combining data access, system execution, and data movement into a single profile, dramatically expanding the enterprise attack surface and rendering patchwork application-layer fixes obsolete.

Cortex AI Gateway operates as a centralized MCP (Model Context Protocol) gateway, integrating Natoma to enforce identity, policy, and audit at the tool-call level. The gateway governs how AI agents—both first-party tools like Snowflake CoCo and CoWork, and third-party ecosystems including Amazon Bedrock, Azure AI Foundry, ChatGPT, Claude Code, Cursor, and custom LangChain or LlamaIndex applications—access models, data, MCP servers, and enterprise tools. Enterprises can manage permissions centrally for MCP tool usage with fine-grained authorization, enabling teams to control who requested each action, what permissions they hold, and whether the action is permitted. The platform delivers three core capabilities: Control allows fine-grained authorization from a single endpoint; Visibility captures agent actions in real time (which tool was called, which system was touched, in what order, by whom); and Cost and Performance automatically route requests to the optimal model based on cost, latency, capability, and data residency while enforcing spending limits by team, agent, or workload.

Several features are in private preview. The Wide Model Catalog lets enterprises bring models (GPT, Gemini, Claude, Grok, Mistral, GLM and more) under one roof and run them in their geography to keep data within required regions. Access Governance and Sprawl Control reduces manual configuration by allowing administrators to grant, restrict, and audit tool access from a single endpoint across dozens of emerging agent types. Govern Every Agent Connection provides streamlined access and data policies, authentication, fine-grained authorization, and permissions across 100+ MCP servers (including bring-your-own and VPC connect), plus automatic discovery and monitoring of shadow AI and MCPs. Observability and Tracing securely captures agent tool calls in real time for comprehensive audit trails. Agent Action Auditability provides an end-to-end record of which systems the agent touched and in what sequence. AI Cost Control gives a unified view of AI consumption by team, agent, or workload while applying budget guardrails and routing to cheaper models for simpler tasks. Intelligent Model Routing automatically directs requests to the right model based on cost, latency, capability, and data residency requirements, including prompt management.

Complementing the gateway, Snowflake transitioned native security features to production. Agent Identity (GA) lets security and governance teams enforce data access policies specific to agent sessions, protecting sensitive data even when an agent runs on behalf of a privileged user, with dedicated agent identity tracking in Account Usage views for auditing. Third-Party Agent Identity extends these frameworks to third-party agents through integrations with 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint, and Saviynt, applying the same governance policies to external AI tools. Restricted Session Scope (GA soon) limits what an agent session can do to only what the task requires, ensuring a read-only analysis stays read-only. Context-Aware Access Policies (private preview) allow security admins to author a single zero-trust policy evaluating identity, network, and client context jointly. Native AI Security Posture Management (GA) integrates AI-specific risk scanning into the Snowflake Trust Center, giving security operations teams a comprehensive dashboard to proactively scan for AI risks, assess compliance postures against emerging regulations, and deploy programmatic remediations. Advanced Data Exfiltration Prevention (in preview via the Trust Center) pairs real-time telemetry with strict data movement policies (GA) to detect and intercept unauthorized data flows—flagging and blocking sensitive data fetches triggered by AI agents, unauthorized data routing to internal or external stages, and mass data downloads via user interfaces. Client-side CoCo CLI VM Sandbox (private preview, currently macOS) isolates each CoCo session in a separate Linux kernel, minimizing exposure of credentials, local storage, or networks to client-side AI workloads, available as either admin-enforced or self-managed control. Ransomware Protection via Multi-Party Approval (MPA) (GA) now requires two or more authorizations before any destructive system change, removing single points of failure and preventing ransomware actors from unilaterally wiping data or altering configurations even if top-tier administrative credentials are compromised. Snowflake is demonstrating these capabilities at Black Hat USA 2026, booth #8206.

The timing of Snowflake's announcement reflects a sharp inflection in enterprise AI risk perception. The Linux Foundation's 2026 State of Tech Talent Report shows AI security concerns jumped to 48% from 17% in just two years—a 181% increase—yet the security infrastructure has not kept pace. While 97% of organizations are committed to implementing AI, 57% lack adequate security and risk management capacity, creating a dangerous gap that autonomous agents have made more acute. Autonomous agents expand the attack surface by consolidating data access, system execution, and data movement into a single profile; traditional application-layer security patches and legacy monitoring tools cannot contain this risk.

Snowflake's response is architectural: rather than bolting security onto agents after deployment, the company embeds governance directly into the data and control planes. The Cortex AI Gateway centralizes identity, policy, and audit at the tool-call level (the granular action level where an agent invokes a model or service) across a fragmented ecosystem—multiple AI models (GPT, Gemini, Claude, Grok, Mistral, GLM), multiple MCP servers (100+ supported), and multiple deployment contexts (internal tools, SaaS, cloud AI services). This unification addresses a core pain point: as enterprises scale autonomous agents, they face fragmented access, no visibility into agent activity, and spiraling AI costs. By routing all agent requests through a single gateway, Snowflake allows teams to grant or deny access, audit every action in real time, and route workloads to cheaper models—all without manually configuring each new agent type.

No comments yet. Be the first to share your thoughts!