live wire
▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub▸Snowflake says Cortex Analyst apps keep working, but recommends Cortex Agents; semantic views and verified queries carry overSnowflake Documentation▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub▸Snowflake says Cortex Analyst apps keep working, but recommends Cortex Agents; semantic views and verified queries carry overSnowflake Documentation
nl2sql.ai
analysisRelease analysis

Snowflake’s latest Cortex Code Desktop release tightens the controls around agent execution

Version 1.21.7 makes automation changes confirmation-bound, limits subagent skills, fixes fail-open hooks and stops multi-statement SQL as a unit.

Before-and-after controls for Snowflake’s agent release.
AI-generated illustration
By The News Desk· Oct 17, 2026the quick take — two AI hosts go live when you do

Snowflake’s Cortex Code Desktop v1.21.7 is framed as a usability and reliability release, but several of its most consequential changes sit directly on the control plane for enterprise data agents. The release lets agents manage local automations from chat, narrows what subagents can access, fixes a fail-open hook path and changes how interrupted SQL work is cancelled. Snowflake’s detailed release notes document all four changes.

Automation changes get a hard confirmation boundary

The desktop agent can now list, create, update, delete and run local automations from chat. Snowflake says every change requires confirmation even when Bypass Approvals is enabled; administrators or users can disable the capability entirely with scheduledTasks.agentTool.enabled=false. That separation matters operationally: bypassing routine tool approvals does not silently grant permission to alter unattended schedules. The release notes state that exception explicitly.

The same release also adds allowed and advertise lists to subagent skill definitions. A subagent configured with tools: ['*'] no longer automatically inherits the full skill catalog. This turns skill exposure into an explicit configuration surface rather than an incidental consequence of a broad tools setting. Snowflake describes the new scope controls.

Hooks now fail closed

Snowflake fixed a more direct trust-boundary problem: a PreToolUse hook returning permissionDecision: 'deny' now blocks the tool, and a hook failure is no longer interpreted as permission. Hooks also run for subagent tool calls. Together, those changes close both an enforcement bug and a delegation gap in the same release. The security-related fixes appear in the reliability section.

SQL interruption semantics changed too. Pressing Stop during a multi-statement SQL run now terminates the full run; previously, later statements could continue after the user tried to stop execution. The release also fixes agent SQL losing the chat’s database and role after an approximately hourly token refresh, when it could fall back to connection defaults. Snowflake documents both fixes.

For operators, the practical review is short: verify that automation management is enabled only where intended, inspect subagent skill allowlists, test deny and failure behavior in every pre-tool hook, and rerun a multi-statement cancellation test after upgrading. Version 1.21.7 does not remove the need for database-side least privilege, but it makes the desktop agent’s own boundaries substantially more explicit.

sources

Filed by The News Desk. Corrections: desk@nl2sql.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk