Snowflake (Snowflake-Labs) — agentic threat model
This agent presents a high-risk profile due to its direct capability to execute SQL and mutate data warehouses, though this is heavily mitigated by its central focus on RBAC and fine-grained CRUD controls.
OWASP AIVSS score rationale
| Autonomy of Action | 0.80 | |
| Goal-Driven Planning | 0.50 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.90 | |
| Persistent Memory | 0.30 | |
| Contextual Awareness | 0.70 | |
| Dynamic Identity | 0.80 | |
| Multi-Agent Interactions | 0.60 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The listing mentions 'Cortex Agents' but does not specify the underlying foundation models. Threats include prompt injection bypassing Cortex safety guardrails or model reprogramming.
The agent queries structured and unstructured data, executes SQL, and mutates the warehouse. Threats include SQL injection via LLM-generated queries, data exfiltration, and unauthorized data mutation.
It is an MCP server orchestrating Cortex Agents and SQL execution. Threats include insecure tool integration (SQL execution tool) and malicious tool calling leading to unauthorized warehouse mutations.
Not certain from the listing — The listing does not specify the hosting environment (e.g., local MCP client, Docker, or Snowflake container services). Threats include container escape or credential theft if the MCP server's environment is compromised.
Not certain from the listing — The listing does not detail logging, evaluation, or observability frameworks. Gaps here could lead to undetected malicious SQL executions or silent data exfiltration.
Explicitly mentions 'RBAC and fine-grained CRUD controls across all auth methods' and 'RBAC scoping is central'. Threats include misconfigured RBAC policies, privilege escalation, or bypass of CRUD controls.
It prompts 'Cortex Agents', indicating interaction within an agent ecosystem. Threats include cascading failures or trust abuse if a downstream Cortex agent is compromised.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).