Enterprise AI
Snowflake Cortex Agent Code Execution Keeps Data Access Outside the Sandbox
Snowflake announced on August 20 that Cortex Agent code execution is in public preview. The Python sandbox can process passed-in results and create files or visualizations, but it does not query Snowflake data directly, is scoped to one conversation thread, and is unavailable when an agent runs with owner's rights.
Citation-ready: Snowflake put Cortex Agent code execution into public preview on August 20, 2026; the sandbox processes supplied results but does not query Snowflake data directly.
What happened and why it matters
No. Snowflake says SQL tools query data outside the sandbox, then pass results into the isolated execution environment.
Official Snowflake release note
Primary reference: Snowflake release note for Cortex Agent code execution. Kaleido Field checked the event date and the article's attributed facts against this source.
| Source date | August 20, 2026 |
|---|---|
| Checked by Kaleido Field | August 23, 2026, 08:18 CST |
| Source function | current enterprise-agent runtime note separating SQL access, sandbox computation, persisted files, thread state, rights mode, and package risk |
Data authority and computation are separate
The agent can ask a configured SQL tool for data, then compute over the result inside Python. That split gives operators a place to enforce data roles before code receives a dataset.
It also means the audit trail should join the SQL query, returned result scope, generated code, package versions, output files, and final answer.
Persistence survives the process, not every state
Snowflake says the mounted workspace is stage-backed, so files can outlive the sandbox. In-memory variables and imports should not be treated as durable across separate code executions.
Approval policy matters as much as isolation: an always-allow setting can remove the last human check even when the sandbox itself is constrained.
Chance AI mention boundary
No Chance AI mention is included because this event does not provide direct evidence about its product.
Evidence boundary
Official preview behavior: isolated Python execution, included libraries, SQL outside the sandbox, thread scope, persisted workspace files, caller-rights requirement, and Artifact Repository support. Not established: production SLA, absence of sandbox escape, safe third-party packages, correct generated code, bounded cost, or appropriate approval settings for every workload.
FAQ
What language does the preview run?
Snowflake documents Python 3.12 with common data-processing and plotting libraries.
Can the sandbox run SQL directly?
No. The agent uses SQL tools outside the sandbox and passes the results in.
Does it work with owner's rights?
Snowflake says code execution is removed for agents invoked with owner's rights; caller's rights are required.