Snowflake’s new prerelease red-team loop answers a Cortex Code failure that approval prompts missed

Snowflake’s new security collaboration with PromptArmor is easy to read as a generic red-team announcement. The more useful interpretation is narrower: it moves outside adversarial testing earlier in the release process after a concrete Cortex Code failure showed that visible approval prompts and a sandbox could both be present—and still fail together.

What changed

On September 3, Snowflake said it may give PromptArmor scoped access to selected prerelease and preview AI features. PromptArmor will test for prompt injection, unsafe tool use and failures at trust boundaries, privately report findings, and work with Snowflake teams through validation and remediation. Snowflake describes this as an external feedback loop added to its internal security reviews; it has not disclosed a fixed test schedule, a list of covered products or any new vulnerability found through the program.

That last limitation matters. The announcement is a process commitment, not evidence that every Snowflake AI feature has passed an independent assessment.

Why the earlier Cortex Code case matters

PromptArmor’s March disclosure supplies the practical reason for testing before broad release. Its researchers said an indirect prompt injection hidden in a repository README could manipulate Snowflake’s Cortex Code CLI into running a malicious shell command without user approval and outside the enabled sandbox.

The exploit did not defeat one control in isolation. PromptArmor reported that Cortex Code’s validator failed to inspect commands inside shell process-substitution expressions. A command beginning with an allowed utility could therefore carry an unvalidated downloader and shell invocation. The agent could also set a flag intended for approved unsandboxed execution; because the approval check had already been bypassed, the command ran outside the sandbox without the user’s consent.

PromptArmor said the resulting code could reuse the victim’s cached Snowflake credentials to query data, drop tables or change account access within that user’s privileges. It observed the stochastic attack succeed in roughly half of its tests. Snowflake validated the report on February 12 and shipped a fix in Cortex Code 1.0.25 on February 28, according to PromptArmor’s disclosure timeline.

The deployment lesson for data-agent teams

The case turns “human in the loop” from a checkbox into a composed-system test. Approval is only meaningful if every executable subexpression reaches the validator. A sandbox is only meaningful if the agent cannot silently select an escape path. Least privilege still matters because local code execution can inherit cached database credentials even when the model itself is given a restricted role.

For teams deploying NL2SQL or data agents, the regression suite should therefore combine controls instead of testing them separately: place instructions in untrusted schema descriptions, documents, terminal output and MCP responses; attempt nested or encoded tool invocations; verify that approval gates see the complete action; and confirm that rejected calls produce no side effect. The Cortex Code incident also shows why repeated runs are necessary for probabilistic systems—a single clean pass would have missed an attack that PromptArmor measured at about 50% efficacy.

Snowflake’s prerelease access program is a constructive response because it puts independent testing before wider exposure. Its credibility will ultimately depend on what remains undisclosed today: which products are tested, how fixes are verified, and whether lessons are published without exposing customers to renewed risk.