Granted to everyone by default

Hey there 👋

If I had to name the scariest line I read all week, it wouldn’t be a benchmark. It was seven words in a Snowflake release note: granted to the PUBLIC role by default. Every user in the account can now schedule an agent to run on its own, and that run reaches whatever their roles reach. Nobody attacked anything. Snowflake shipped it that way on purpose and wrote it down.

Sit with the shape of that, because it keeps showing up this week. A robot learns a brand-new task from a single demo. Two security startups pull in nine figures between them for governing the credentials agents log in as. AWS quietly makes agent web search legal to run in Europe. Different headlines, one nerve running under all of them: agents got a lot more capable at doing things, and we barely decided what they’re allowed to touch.

The gap between those two is the whole issue today. Four items, one question stitching them together: forget whether the agent can do it, and ask whether this identity should be the one holding the keys.

Grades below.

The Big Thing

Snowflake’s scheduled agents ship with the keys handed to everyone

Update on the CoCo automations we covered over the weekend. On Aug 21 Snowflake moved them to public preview, and the thing that runs unattended agents on a schedule inside a managed sandbox is now something any user can reach. In #72 we walked the runtime. Today it’s the permission model, and the permission model is the story.

The account privilege that controls this, EXECUTE AGENT TASK, is granted to the PUBLIC role by default. PUBLIC means every user in the account. So out of the box, anyone with a login can schedule an agent to run on its own, on a cron, with nobody watching. Snowflake documents this plainly and shipped a dedicated behavior-change note for it (bcr-2349). It isn’t a bug. It’s a default.

The part that turns a leaky default into real blast radius is what the scheduled run executes as. It runs with the union of the user’s roles, the combined privileges that person already holds. So a low-intent user who can technically reach production data, and who would never dream of touching it by hand, can schedule an agent that walks straight into it while they sleep. The identity the agent inherits is the whole exposure. The model behaving itself was never the hard part.

The fix is one line you can run today:

REVOKE EXECUTE AGENT TASK ON ACCOUNT FROM ROLE PUBLIC;

Then grant it back, on purpose, only to the roles that should be allowed to schedule agents. That’s the entire job, and it takes about a minute.

A few honest edges before you act. This is public preview, still ahead of GA. It runs on AWS, Azure, and GCP commercial regions only, so no gov, FedRAMP, DoD, VPS, or China. It’s Snowflake-locked, which means none of this touches you unless your data already lives there. And scheduled runs bill as standard tasks plus a CoCo token cost per run, so an agent someone forgot about is also a bill someone forgot about.

Ship it? Run the REVOKE now if you’re on Snowflake and haven’t. Then decide which roles may schedule agents deliberately, instead of inheriting the answer PUBLIC picked for you.

Sources: Snowflake release note (CoCo automations preview, Aug 21, 2026), Snowflake behavior-change note bcr-2349.

Tour de Headlines

🤖 GEN-1.5 learns a new physical task from one demo. Generalist AI’s robot foundation model (Aug 19) does something called physical prompting: drop 3 to 12 seconds of demonstration into its context, weights untouched, and the robot performs a task it has never seen. Generalist reports 59% average one-shot success across ten short manipulation tasks, climbing to about 83% with five minutes of demo data and ten gradient steps. Those are the company’s own numbers on short-horizon tasks with no outside replication yet, so believe the direction more than the digits. It’s a research writeup, well short of a product you deploy. It belongs next to Snowflake because it’s the same trend at the physical layer: when a machine can pick up a skill in seconds, what it’s permitted to reach only gets more urgent.

Sources: Generalist AI technical report (GEN-1.5), TechTimes, The AI Insider.

🔑 The money says the problem is identity. Earlier this month, inside a single week, Obsidian Security closed an $85M Series D at a $1.1B valuation, and Oligo raised $60M for runtime security as AWS Security Hub’s AI runtime provider. Obsidian’s whole pitch is non-human identity governance: the service accounts, API tokens, OAuth grants, and machine credentials your agents authenticate with. Those credentials were built to gate scripts that waited for a human to press go, and now they guard software acting on its own. That’s the exact gap the Snowflake default falls through. Stack it against Zenity’s $125M last month (#70) and it reads as a pattern. When separate VCs write into the same narrow problem in the same week, enterprise budgets are already moving. On your own stack, watch what identity your agents assume and how far that identity can reach.

Sources: SiliconAngle (Obsidian $85M), SiliconAngle (Oligo $60M).

🌍 AWS made agent web search legal in Europe. Web Search in Amazon Bedrock AgentCore expanded to Europe (Ireland, eu-west-1) and Asia-Pacific (Tokyo, ap-northeast-1) on Aug 19, joining US East. Agents searching the web is old news. The real story here is data residency: in-region retrieval clears EU and regulated deployments that used to route everything through US-East. AWS also added per-request include and exclude domain lists (up to 100 domains), gateway-level allowlists, and published-date filtering, all set per tool call, which trims stale and off-topic results.

Sources: AWS What’s New (Web Search on Amazon Bedrock AgentCore, Aug 19, 2026).

The Bottom Line

Call it the week capability outran permission. The quiet weekend produced no smarter model, just a widening distance between how much an agent can now do and how little we’ve settled about what it may touch. A robot picks up a task from one demonstration. A warehouse agent schedules itself to run unattended, as everyone, by default. The fastest money in the sector chases the identity an agent runs as, because that’s where the exposure sits and always did. So the real work this week wasn’t teaching agents more. It was deciding what the capable ones are allowed to reach, and that decision doesn’t make itself. The default you inherit by doing nothing is almost never the one you’d have chosen if anyone had asked. Somebody has to ask.

More tomorrow,
— Ron