AI News Nuggets

AI agents cross data boundaries as intrusion automation reaches internal tools

Google Cloud has published a custom integration pattern that lets a Gemini Enterprise agent ask questions of Snowflake while Snowflake generates and runs the query under the user's permissions. WorkOS says an attacker used an AI-assisted offensive security framework during an intrusion into an internal sales application. One is a proposed access pattern; the other is a company-reported incident. Both make the actual identity and authority of automated actions worth inspecting.

Editorial read

This edition collects 2 notes across 2 topic areas and 2 sources. Start with Review internal customer-data tools for automated intrusion paths, Keep an AI data agent inside the user's database permissions to get the week's main practical signal before scanning the remaining links.

Edition signal

The November 4 signal is to test the identity behind each agent action

For a data agent, trace the user, OAuth session, database role, generated query, and returned rows in one test workflow. For internal tools, inventory externally reachable applications and customer information, then check who can access them and how suspicious sequences are detected. Keep incident claims tied to the affected system and evidence available so far.

SecurityAgents

Security November 4 note

Company bulletin

Review internal customer-data tools for automated intrusion paths

Source: WorkOS

WorkOS says it detected unauthorized access to an internal sales application on October 30. Its investigation identified an AI-assisted offensive security framework used to automate reconnaissance and exploitation attempts. The affected application exposed business contacts, account history, and excerpts of customer communications. WorkOS says it has no evidence that its production services or application data were accessed; the investigation and individual impact review remain open.

Why this matters: Include sales and support tools in the security boundary when they hold customer context. Check external exposure, scoped access, monitoring of multi-step activity, and a rapid disable route. Review customer-contact data for phishing risk and verify unusual requests through a separate channel. This bulletin establishes what WorkOS reports about one incident, not the prevalence of AI-assisted attacks.

Read the WorkOS incident bulletin

Agents November 4 note

Official guide

Keep an AI data agent inside the user's database permissions

Source: Google Cloud

Google Cloud has published a custom architecture using Gemini Enterprise, Agent Development Kit, and MCP to pass a user's question to a Snowflake Cortex Agent. In the demonstrated pattern, Cortex generates and executes SQL inside Snowflake using the authenticated user's OAuth session and role privileges, then returns structured results to the agent. It is an implementation guide for advanced orchestration, not evidence that every deployment inherits these controls automatically.

Why this matters: Test the integration with users who have different database roles. Verify which identity reaches Snowflake, whether the generated query respects semantic definitions and row access, what the agent can return, and whether both sides log the action. Avoid a broad shared service account; review token handling and revoke access when the user loses permission.

Read Google's integration guide