CLAIM-2026-08-25-04

The EXECUTE AGENT TASK account privilege required to create a CoCo automation is granted to the PUBLIC role by default, so every user in the account holds it unless an administrator changes the grant.

Why it matters

Makes the exposure account-wide by default and gives the one-line Monday remediation.

Sources

• snowflakedo2026coco