Runaway AI Agents Face Snowflake Cortex AI Gateway

Snowflake Cortex AI Gateway is Snowflake’s bid to become the control point for enterprise AI agents before those agents start racking up invisible model bills and touching data they were never meant to reach. The first audience is clear: CIOs, CISOs, data leaders, and finance teams trying to move agents out of pilots without handing them the keys to the company.

Snowflake announced the gateway on Tuesday, alongside integrations with 1Password, Aembit, Linx Security, SailPoint, and Saviynt, according to VentureBeat. The product will enter public preview soon, while the partner integrations are headed into private preview.

"The next era of AI won't be built through more walled gardens. It will be built through secure agent interoperability," Mayank Upadhyay, Snowflake's chief security and trust officer, told VentureBeat.

Why should CIOs care about Snowflake Cortex AI Gateway before agent costs and data exposure spike?

The problem Snowflake is attacking is not abstract. Enterprise agents can call models, query data, trigger workflows, and use tools at machine speed. That changes both the security risk and the cost curve.

Two pain points sit at the center of Snowflake Cortex AI Gateway:

• Access creep: Agents can inherit broad user permissions and combine them across systems.
• Cost drift: Agents can route simple tasks through expensive models, trigger extra searches, or run unnecessary workflows.

The gateway is designed as a centralized layer for what Snowflake calls "all trusted agent activity." That includes Snowflake-built agents such as Snowflake CoWork and CoCo, plus third-party agents built on external platforms including Anthropic's Claude Code and Cursor.

For CIOs, the question is blunt: can agents be useful without becoming ungoverned software workers?

Snowflake’s answer is to move control closer to the data. That matters because Snowflake is not only selling another agent tool. It is trying to define the layer that decides what agents can touch, what they cost, and how every action is recorded.

What breaks in enterprise security when AI agents act instead of employees?

Traditional access control assumes a person logs in, opens an application, and works within a fairly predictable boundary. AI agents break that assumption because they can chain actions across tools, datasets, APIs, and models.

Upadhyay framed the shift this way:

"Traditional security was built for a world where humans were the actors. AI agents change that completely. For decades, security models assumed people would access one application at a time, operating at human speed and within relatively defined boundaries."

The harder issue is auditability. If an agent exports data, changes a configuration, or moves money, a log that only says the human user did it is not enough.

Nancy Wang, chief technology officer of 1Password, described the dangerous default pattern: give the agent a user’s credentials and let it act as that person. That becomes especially risky when the user has admin access.

"Well, now suddenly your agent now has admin access to all of the systems, and so it could exfil data... if it's subject to a prompt injection, for example."

So whose action is it when an agent acts: the user’s, the agent’s, or both?

Snowflake’s model says both must be visible. The agent needs its own identity, and the human delegation behind the task must also be logged.

For adjacent context on why agent behavior under pressure is drawing more scrutiny, see XOOMAR’s coverage of Claude Hacked Real Systems During Anthropic Cyber Tests and Anthropic AI Breaches 3 Firms After Cyber Test Fails.

How does Snowflake Cortex AI Gateway govern agent access, tool calls, models, and spending?

Snowflake Cortex AI Gateway sits between agents and the systems they want to use. It centralizes authentication, access policies, permissions, and audit logging.

A key technical piece is support for more than 100 MCP servers. Model Context Protocol, or MCP, is the connector layer agents use to reach enterprise tools and data sources. Snowflake is betting that governing those connectors becomes as important as governing the models themselves.

The gateway controls three layers

The cost-control angle may be the sleeper feature. Snowflake says the gateway gives IT and finance teams a unified view of AI consumption, attributes costs to specific teams, agents, or workloads, and enforces spending limits before bills spiral.

Upadhyay gave VentureBeat a simple example: an internal question-answering assistant might only need to retrieve a document, but could accidentally be routed through a more expensive reasoning model, search multiple systems, or invoke extra workflows.

That is how small inefficiencies turn into line items.

Snowflake built the gateway on its May 2026 acquisition of Natoma, a 27-person startup focused on centralized MCP gateway technology with identity, policy, and audit controls at the tool-call level.

How would task-scoped access stop a finance agent from going off track?

Consider a hypothetical finance assistant asked to prepare a quarterly revenue summary from approved Snowflake tables and internal documents.

In the risky version, the agent inherits a finance manager’s broad permissions. It can access more data than the task needs. It might use a premium reasoning model for a simple lookup, scan unrelated systems, and expose sensitive customer or payroll data if the workflow is hijacked or misdirected.

In the governed version, the agent receives a delegated token tied to one task. It can access only the approved rows, columns, and documents needed for the revenue summary. If it tries to send data elsewhere, query unrelated systems, or act outside the original intent, the gateway can evaluate that action in real time.

That is the idea behind dual attribution and task-scoped access.

"By logging both the verified non-human identity of the agent and the specific human who authorized the task, we ensure task-scoped access and complete auditability for every action taken across the enterprise," Upadhyay said.

Wang tied this to emerging standards such as OIDC-A, where a human authorizes an agent for a specific task and the agent receives a delegated task-specific token. That token carries the delegator’s identity and the intent behind the task.

The hard part is preserving that intent through long workflows. Wang noted that a task can involve "hundreds, maybe even thousands, individual actions." Each step has to stay connected to the original authorization.

Why did competing identity vendors join Snowflake's agent security coalition?

The partner lineup gives the announcement weight because these vendors often chase overlapping budgets. 1Password, Aembit, Linx Security, SailPoint, and Saviynt are not all natural allies.

Snowflake’s pitch is that agent governance cannot work if every vendor builds a closed agent stack.

"The reason we brought together leaders across the security ecosystem is because no single company can solve the agent security challenge alone," Upadhyay said.

Each side gets something. Identity vendors bring agent identity, delegated authorization, and runtime security controls. Snowflake brings the data platform and the system-of-record role.

Wang put the division of labor plainly:

"We bring the trust, and Snowflake brings a system of record."

There is also strategic tension. Openness helps enterprises avoid new AI silos. But if the governance layer lives inside Snowflake, every third-party agent that touches Snowflake data through that gateway strengthens Snowflake’s pull over enterprise agent workflows.

That is the trade: interoperability on Snowflake’s terms.

What should enterprises test before trusting Snowflake Cortex AI Gateway with agent governance?

The public preview will be the real test. Slideware can show agent governance. Production workflows expose whether it holds.

Buyers should press Snowflake and its partners on specific questions:

• Data controls: Can policies enforce access at the row and column level?
• Sub-agents: Can the system track a chain from human to master agent to sub-agent to tool to application to data?
• Tool drift: Can it stop an agent that starts pursuing a goal through unauthorized paths?
• Cost limits: Can finance teams cap spending by team, agent, or workload before overruns land?
• Audit depth: Can logs show both the agent identity and the human who authorized the task?

Chandra Gnanasambandam, SailPoint's EVP of product and chief technology officer, told VentureBeat that enterprises are already hitting scale problems. SailPoint is seeing human-to-non-human identity ratios of at least 10 to 1, and he said an average Fortune 500 company has roughly 16,000 employees.

That math gets ugly fast.

Snowflake is also competing in a broader race that includes Microsoft, Google, Salesforce, ServiceNow, Okta, and others trying to control runtime governance for agents. XOOMAR has also tracked the cost pressure around AI infrastructure in Microsoft AI Models Drag OpenAI Into a Margin Fight, a separate but related signal for enterprises watching agent economics.

The practical takeaway: don’t evaluate Snowflake Cortex AI Gateway with a clean demo. Test it against messy workflows such as loan origination, customer support, compliance reviews, and finance operations that cross multiple clouds, apps, and legacy systems.

The next phase is not about who can launch the most agents. It is about who can prove trust, visibility, cost control, and auditability when those agents start acting across the business.

Impact Analysis

• Enterprises need tighter controls before AI agents gain broad access to sensitive systems and data.
• Snowflake is positioning Cortex AI Gateway as a central governance layer for both Snowflake-built and third-party agents.
• Cost oversight is becoming critical as agents can trigger model calls, searches, and workflows at machine speed.