Snowflake launches AI agent security gateway at Black Hat 2026

Snowflake unveiled Cortex AI Gateway at Black Hat 2026, a new control layer designed to centralize governance of how AI agents access models, data, and enterprise tools. The gateway integrates Natoma, an MCP (Model Context Protocol) centralized gateway, into the Snowflake ecosystem to enforce identity, policy, and audit controls at the tool-call level. This allows enterprises to manage agent access across both first-party Snowflake tools (CoCo and CoWork) and third-party platforms including Amazon Bedrock, Azure AI Foundry, ChatGPT, Claude Code, Cursor, and custom LangChain or LlamaIndex applications.

The timing reflects an urgent security landscape shift. According to The Linux Foundation's 2026 State of Tech Talent Report, AI security concerns have surged from 17% in 2024 to 48% in 2026. This acceleration occurs even as 97% of organizations are committed to implementing AI—yet 57% face a significant capacity gap in security and risk management. The article attributes this vulnerability partly to autonomous agents, which combine data access, system execution, and data movement into single profiles, dramatically expanding the enterprise attack surface. Decentralized adoption of agents creates unmanaged sprawl, fractured visibility, and exposure to unvetted servers, tool hijacking, and data exfiltration.

Cortex AI Gateway delivers three core capabilities. Control allows enterprises to grant, restrict, and audit model and tool access from a single endpoint with fine-grained authorization, eliminating the need to manually configure each new agent type. The Wide Model Catalog (in private preview) consolidates GPT, Gemini, Claude, Grok, Mistral, GLM and others under one roof, running them in specified geographies to keep data within required regions. Access Governance and Sprawl Control (private preview) reduces the administrative burden of manually configuring connections for emerging agent types. Govern Every Agent Connection (private preview) provides streamlined access and data policies, authentication, and authorization across 100+ MCP servers, including bring-your-own (BYO) and VPC connect options, with automatic discovery and monitoring of shadow AI. Visibility is achieved through real-time capture of agent actions—which tool was called, which system it touched, and in what sequence—feeding into audit trails for security and compliance teams. Observability and Tracing (private preview) securely captures tool calls for usage tracking, troubleshooting, and forensics. Agent Action Auditability (private preview) provides an end-to-end record of agent actions and the systems they touched. Cost and performance controls include AI Cost Control (private preview), which offers a unified view of AI consumption by team, agent, or workload and enforces spending limits before costs escalate, and Intelligent Model Routing (private preview), which automatically routes requests to the right model based on cost, latency, capability, and data residency requirements.

Complementing the gateway, Snowflake transitioned several AI security features to general availability or public preview. Agent Identity is now GA, enabling security and governance teams to enforce data access policies specific to agent sessions and adding dedicated agent identity tracking in Account Usage views. Third-Party Agent Identity extends these frameworks to external AI tools through integrations with security vendors including 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint, and Saviynt. Restricted Session Scope (GA soon) limits what an agent session can do to only what the task requires. Context-Aware Access Policies (private preview) are a zero-trust control allowing security admins to evaluate identity, network, and client context in a single expression. Native AI Security Posture Management is now GA, offering a comprehensive dashboard in the Snowflake Trust Center to proactively scan for AI-specific risks, assess compliance postures against emerging global regulations, and deploy programmatic remediations. Advanced Data Exfiltration Prevention (now in preview via the Trust Center) pairs real-time telemetry with strict data movement policies to detect and intercept unauthorized data flows—including sensitive data fetches triggered by AI agents, unauthorized data routing to internal or external stages, and mass data downloads. Client-side CoCo CLI VM Sandbox (private preview) isolates each CoCo session in a separate Linux kernel on macOS, minimizing exposure of credentials and local storage to client-side AI workloads. Ransomware Protection via Multi-Party Approval is now GA, requiring two or more authorizations before destructive system changes, preventing single-point-of-failure compromise of sensitive architecture.