My CoWork Agent Burned Through $800 in Credits Before Anyone Noticed
A single unbounded CoWork agent session consumed $800 in credits due to infinite reasoning loops, highlighting critical risks in autonomous agent compute consumption. Snowflake’s CoWork RBAC strictly enforces the user's default role for all agent interactions, requiring specific granular grants for semantic views, search services, and agents themselves. Effective cost governance requires a layered approach combining statement timeouts, warehouse isolation, and resource budgets with automated thr
Analysis
TL;DR
- A single unbounded CoWork agent session consumed $800 in credits due to infinite reasoning loops, highlighting critical risks in autonomous agent compute consumption.
- Snowflake’s CoWork RBAC strictly enforces the user's default role for all agent interactions, requiring specific granular grants for semantic views, search services, and agents themselves.
- Effective cost governance requires a layered approach combining statement timeouts, warehouse isolation, and resource budgets with automated threshold actions.
- The CORTEX_AI_FUNCTIONS_USAGE_HISTORY table provides essential token-level cost visibility per query, model, and user, enabling precise monitoring of AI spend.
- Distinction between CORTEX_USER (broad access) and CORTEX_AGENT_USER (agent-only access) is vital for minimizing privilege escalation and securing enterprise environments.
Why It Matters
This case study serves as a stark warning for AI practitioners deploying autonomous agents: without strict guardrails on execution time and tool usage, agents can incur exorbitant costs through recursive loops. It underscores the necessity of implementing robust governance frameworks, including budget controls and precise RBAC configurations, to ensure that AI initiatives remain financially sustainable and secure within enterprise data ecosystems.
Technical Details
- Cost Incident Analysis: An agent with broad tool access (semantic views, Cortex Search, SQL execution) entered a 47-minute reasoning loop, generating an $800 bill. The root cause was the absence of configuration limits on execution duration rather than data access violations.
- RBAC Configuration: CoWork interactions run under the user’s default role. Proper setup requires granting
USAGEon databases/schemas,SELECTon semantic views,USAGEon Cortex Search services, andUSAGEon the Agent object itself. A common error is usingUSAGEfor semantic views or incorrect keywords for agent creation. - Privilege Granularity: Snowflake offers distinct database roles:
SNOWFLAKE.CORTEX_USERgrants access to all Cortex features, whileSNOWFLAKE.CORTEX_AGENT_USERrestricts access to agents only, allowing for tighter security postures. - Monitoring and Governance Tools: The
CORTEX_AI_FUNCTIONS_USAGE_HISTORYtable (General Availability March 2026) enables per-query, per-model, and per-user token-level cost tracking. Combined with statement timeouts and warehouse isolation, these form a comprehensive cost control strategy. - Resource Budgets: General Availability for Cortex Agents and CoWork includes monthly credit limits with automated actions when thresholds are reached, providing a proactive mechanism to prevent runaway costs.
Industry Insight
- Implement Hard Limits Early: Organizations must configure statement timeouts and resource budgets before deploying agents in production. Relying solely on human oversight is insufficient given the speed at which agents can consume resources.
- Audit Tool Access Policies: Review agent tool permissions rigorously. Broad access to multiple semantic views and search services increases the attack surface for both cost overruns and potential data exposure. Principle of least privilege should apply to tool invocation, not just data access.
- Leverage Usage History for FinOps: Integrate
CORTEX_AI_FUNCTIONS_USAGE_HISTORYinto financial operations (FinOps) dashboards. Token-level visibility allows teams to identify inefficient agent behaviors or expensive models early, optimizing AI spend before it escalates.
Disclaimer: The above content is generated by AI and is for reference only.