CrowdStrike Advances AI Security and Safety from Endpoint to Cloud

CrowdStrike unveiled new AI detection and response (AIDR) capabilities for Falcon Guardian at Fal.Con Europe 2026, including a new AI kill switch that lets security teams cut off AI model access at AI gateways when agents behave dangerously. CrowdStrike also announced general availability of Falcon Complete for Guardian, extending 24/7 managed detection and response to AI security, and detailed three-layer agent protection spanning OS-level runtime security (available now), endpoint network inspection (pre-beta, expanding to macOS), and agent-level hooks for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode, and Cursor (available now). The company said it will extend Falcon Guardian coverage to Linux, cloud workloads, Kubernetes, and managed AI platforms in pre-beta.

AI agents are transforming enterprise computing. What began with employees using AI assistants is evolving into autonomous agents that access enterprise resources, invoke tools, execute code, and take action at machine speed. This introduces a new security and safety challenge. Organizations must protect agents from attacks while ensuring those agents operate safely and as intended. Security teams need to discover where agents operate, understand what they were instructed to do, trace their actions, and intervene when their behavior becomes dangerous. Traditional security approaches provide only part of the picture. Endpoint runtime security monitors execution but lacks the AI-specific context needed to explain what triggered it. Network inspection can monitor AI communications but not the actions that agents take on systems. Agent-level integrations can inspect AI interactions but cannot reveal downstream execution. At Fal.Con Europe 2026, CrowdStrike unveiled innovations that advance AI detection and response AIDR across three critical dimensions: architecture, coverage, and controls. We also introduced a new AI kill switch for CrowdStrike Falcon® Guardian that empowers security teams to rapidly cut off AI model access at AI gateways when agents become dangerous. And we shared the general availability of CrowdStrike Falcon® Complete for Guardian, which extends 24/7 managed detection and response to AI security. The Right Architecture for Securing AI Agents Securing AI agents requires visibility and control across three critical layers: OS-level runtime execution, network communications, and agent interactions. Falcon Guardian brings these layers together to connect what agents are instructed to do with what they execute. OS-level runtime security is the foundation Available now : The Falcon sensor provides deep visibility into agents’ activity, including the processes they launch, commands they run, and resources they access. This visibility is not achievable directly via network inspection or per-agent hook integration approaches. Endpoint network inspection extends visibility into agent communications Pre-beta : CrowdStrike announced plans to expand this capability to macOS, where it will inspect traffic entering and leaving the endpoint to help security teams identify risky interactions. Agent-level hooks provide direct inspection and policy enforcement within supported AI agents Available now : Hooks for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode, and Cursor enable organizations to inspect prompts and block malicious activity at the source, before harmful actions are executed. Together, these three layers give Falcon Guardian visibility into agent instructions, communications, and runtime execution. CrowdStrike® Agent Graph connects this activity, linking what agents were instructed to do with what they actually executed and the resources they affected. This gives security teams the context to understand agent behavior, investigate threats, and trace their impact from prompt to process. See it in action: The Right Coverage: Secured AI Wherever It Operates Falcon Guardian initially focused on securing workforce AI adoption and autonomous agents at the endpoint, where employees interact with AI and agents execute with user permissions. Now, as enterprises build and deploy their own agents in production environments, CrowdStrike is expanding Falcon Guardian's AI-specific protections across more of the cloud infrastructure the CrowdStrike Falcon® platform already secures. Newly announced capabilities will extend Falcon Guardian coverage across Linux, cloud workloads, Kubernetes, and managed AI platforms. Expanded cloud coverage Pre-beta : On Linux, Falcon Guardian will bring agent discovery, visibility, and AI-specific detections to Claude Code and OpenAI Codex. In cloud workloads and Kubernetes, Falcon Guardian will extend these capabilities to enterprise-developed AI agents and applications, including those built with LangChain and LangGraph. Using the Falcon Linux sensor, deployed directly or as a Kubernetes DaemonSet, Falcon Guardian will connect AI activity with surrounding runtime, workload, and identity context. For provider-managed AI environments, Falcon Guardian will expand agent discovery and AI-layer visibility, beginning with Amazon Bedrock AgentCore. This will help security teams identify managed agents, understand their components and interactions, and assess AI-specific risks without requiring access to provider-controlled infrastructure.