A Cortex AI agent is an AI-driven workflow or application built inside Snowflake Cortex that can query data, generate content, or orchestrate tasks. Because it operates near governed data, it can inherit access, execute logic autonomously, and create security and compliance exposure if permissions and guardrails are not aligned.
Expanded Definition
A Cortex AI agent is not just a chatbot layered onto analytics. In the Snowflake Cortex context, it is an AI-driven workflow that can query governed data, generate outputs, and orchestrate actions with system-level context. That makes it an NHI concern because the agent may operate under service permissions, inherit dataset access, and trigger downstream processes without a human in the loop. Definitions vary across vendors, but the core security question is consistent: what can the agent see, what can it do, and what evidence exists for each step?
This term overlaps with agentic AI, data assistants, and workflow automation, but it becomes materially different when the agent is allowed to reach sensitive records, invoke tools, or persist state. NHI Management Group treats Cortex AI agents as identity-bearing actors that need scoped entitlements, logging, and revocation paths, not merely model prompts. The most common misapplication is treating the agent as a harmless UI feature, which occurs when teams map its access to broad warehouse roles instead of task-specific boundaries.
For adjacent risk framing, compare the broader OWASP NHI Top 10 with the standards perspective in the NIST AI Risk Management Framework.
Examples and Use Cases
Implementing Cortex AI agents rigorously often introduces a governance tradeoff: tighter data boundaries and approvals improve safety, but they can slow experimentation and reduce the agent’s usefulness for business users.
- A finance team uses a Cortex AI agent to summarize quarter-end performance from governed tables, with read-only access and audit logging tied to the workflow owner.
- A support organization lets an agent draft customer responses from case data, but blocks it from seeing payment fields and secrets stored in adjacent systems.
- A data engineering team configures an agent to generate SQL and run approved transformations, while requiring human review before any write action is executed.
- A security team tests whether an agent can be induced to overreach from a prompt injection path, similar to the scenario discussed in Gemini AI Breach — Google Calendar Prompt Injection.
- An enterprise compares its agent governance model against the OWASP Agentic AI Top 10 before exposing production data to a new Cortex workflow.
These patterns are especially important when the agent’s actions resemble the failures documented in Replit AI Tool Database Deletion, where autonomy collided with insufficient guardrails.
Why It Matters in NHI Security
Cortex AI agents matter because they can become high-trust NHIs with broad visibility into data, credentials, and operational context. If permissions are too wide, an agent can expose sensitive records, generate unsafe outputs, or trigger business actions that were never intended. NHI Management Group research shows that 80% of organisations report AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials, which underscores how quickly autonomy turns into exposure when governance lags.
The risk is not limited to model quality. It also includes secret handling, entitlement creep, weak review processes, and blind spots in audit trails. That is why Cortex AI agents should be governed like privileged service identities, with explicit ownership, task scoping, and revocation discipline. Security teams should also align implementation with the CSA MAESTRO agentic AI threat modeling framework and the MITRE ATLAS adversarial AI threat matrix when assessing abuse paths.
Organisations typically encounter the full blast radius only after an agent has already read, copied, or acted on data outside its intended scope, at which point Cortex AI agent governance becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Agentic apps are defined by delegated actions and tool use, which matches Cortex AI agents. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Cortex AI agents behave like privileged NHIs when they access governed data and perform actions. |
| NIST AI RMF | AI RMF addresses governance, accountability, and harm reduction for autonomous AI systems. | |
| NIST Zero Trust (SP 800-207) | AC-3 | Zero trust requires explicit authorization for each access decision an agent makes. |
| CSA MAESTRO | MAESTRO maps agentic AI threat surfaces, including autonomy, tools, and data exposure. |
Scope the agent's tools, memory, and actions to least privilege before production release.
