CrowdStrike launched an AI kill switch for Falcon Guardian on 3 November, adding an immediately available gateway-level control to its agent-security platform at Fal.Con Europe 2026, the company said. The control lets security teams cut an agent’s access to AI models through a gateway when they decide it has become dangerous.
Key points
- The available control can stop agents at the gateway, block relaunches and revoke network access.
- A security administrator must decide whether detected activity is benign or malicious.
- Direct termination on endpoints is planned for a later release.
- CrowdStrike also announced a Claude Cowork integration and agreements to buy Fiddler AI and Dreadnode.
Falcon Guardian control starts at the gateway
Falcon Guardian, launched in September to secure enterprise AI agents, gives CrowdStrike customers a way to monitor agents operating within their systems, CNBC reported. CrowdStrike Chief Business Officer Daniel Bernard told CNBC that its process can detect internal agent activity, but a person must determine whether that activity is benign or malicious. The decision to stop an agent remains with the security team.
The current kill switch can stop agents through gateway controls, prevent them from relaunching and revoke their enterprise network access, Stocktwits reported. CrowdStrike says administrator-triggered actions are recorded in audit logs. Direct termination of an agent on an endpoint is planned for a later release, according to Stocktwits.
Constellation Research, an enterprise technology research firm, reported a different description of the control: an agent that breaks its intended behaviour can be terminated “where it runs”, Constellation Research reported. Stocktwits described the available capability as gateway-based, with direct endpoint termination to follow later.
Bernard described the shutdown decision as important to companies adopting AI agents. “Having the ability to control and turn off, and make a decision and decide, I think that’s really important for this next chapter of AI adoption,” he told CNBC. The company’s description of the available control centres on cutting off an agent’s model access at an AI gateway.
Claude Cowork protection is in pre-beta
CrowdStrike also announced an integration with Anthropic’s Claude Cowork. It says the integration places Falcon sensor protection inside the virtual machine where Claude Cowork runs, giving security teams visibility into the agent’s execution environment. CrowdStrike lists that integration as pre-beta, while the kill switch is available to Falcon Guardian customers.
The company says Falcon Guardian can already inspect prompts through hooks for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode and Cursor. It separately announced general availability of Falcon AI Gateway, which it says applies centralised policy to supported AI traffic and is included with Falcon Guardian. Those controls operate at different points: within supported agents, at the gateway and, through the Falcon sensor, where processes run.
CrowdStrike also outlined pre-beta plans to extend Falcon Guardian coverage to Linux, cloud workloads and Kubernetes. The planned coverage includes enterprise-built agents and applications using LangChain and LangGraph. For provider-managed environments, the company says it will begin with agent discovery and AI-layer visibility for Amazon Bedrock AgentCore.
Fiddler AI and Dreadnode add testing
Alongside the product announcements, CrowdStrike announced agreements to acquire Fiddler AI, an agent-observability company, and Dreadnode, which provides automated AI security testing. A previous AI Affairs report put the combined price at a reported $495 million. CrowdStrike plans to fund the transactions primarily with cash and partly with stock, according to Stocktwits.
Fiddler’s technology is intended to trace agents’ decisions, tool use and behaviour within Falcon, and to let customers evaluate agents before deployment. CrowdStrike plans to offer it as Falcon Observe. Dreadnode’s automated tests are intended to identify weaknesses in models, applications and agents before deployment, with findings feeding security-policy recommendations into Falcon Guardian.
That would add monitoring and testing to the shutdown control already available in Falcon Guardian. CrowdStrike expects both acquisitions to close in its fiscal fourth quarter of 2027.
.jpg){kind=link}