live wire
▸Snowflake agent evals can pin judge versions; unpinned metrics may roll forward and shift scoresSnowflake▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub▸Snowflake agent evals can pin judge versions; unpinned metrics may roll forward and shift scoresSnowflake▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub
nl2sql.ai
releaseEnterprise agents

Snowflake CoWork can now turn analysis into files—but the export path changes the agent’s security model

PDF, Word, PowerPoint and HTML generation is generally available, yet every export depends on a code sandbox with its own rights, persistence and approval boundaries.

Snowflake CoWork export path changes security controls.
Side by side: what changed
By The News Desk· Oct 15, 2026the quick take — two AI hosts go live when you do

Snowflake has made document generation in CoWork generally available, letting an analyst turn a conversation into a PDF, Word document, PowerPoint deck or HTML file and inspect the result inline. The feature sounds like an output-format upgrade. Operationally, it is also a change to the agent’s execution surface: Snowflake says document generation only works when the associated Cortex Agent has its code execution tool enabled.

The export is a code workload

According to Snowflake’s GA notice, CoWork assembles each file through the Cortex Agent code execution tool. The document-generation guide says the agent can reuse the conversation context and its configured data tools, and that user or agent skills can override built-in behavior—for example, by enforcing a standard deck structure or company template.

That means teams should not treat “generate a deck” as a cosmetic final step. It invokes an execution environment. Snowflake’s code-execution documentation says the sandbox is isolated from direct warehouse access and can work only with data passed into the session plus mounted workspace content. SQL retrieval happens through the agent’s SQL tools outside the sandbox.

Three controls need review

First, the sandbox can read and write the user workspace stage. Files written there persist after the sandbox suspends, even though in-memory state does not. Teams therefore need retention and access rules for generated files, not just for the chat that produced them.

Second, Snowflake says code execution is unavailable when an agent is invoked through an owner’s-rights stored procedure; the tool is removed from the request and the response includes a warning. A workflow that succeeds interactively under caller’s rights can therefore fail when wrapped in a privileged automation path.

Third, state-changing sandbox tools use an always_ask approval policy by default, but administrators can change that policy to always_allow. Snowflake explicitly recommends skipping confirmation only for trusted automated workflows. That setting deserves a separate review from the agent’s warehouse privileges because it governs what the execution environment may do, not what SQL the agent may query.

The practical rollout checklist is short: enable code execution only on the agents that need exports, test the actual caller-rights path, decide where generated files may persist, and keep confirmation enabled unless automation genuinely requires otherwise. GA removes the preview label; it does not remove those control-plane decisions.

sources

Filed by The News Desk. Corrections: desk@nl2sql.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk