CrowdStrike adds an AI Kill Switch to Falcon Guardian

CrowdStrike has added AI Kill Switch to Falcon Guardian, its AI Detection and Response (AIDR) platform for monitoring AI agents in enterprise environments. The company says the feature is designed to stop an agent that moves outside its intended behavior.

An authorized administrator triggers the action. According to CrowdStrike, the Falcon sensor first stops the agent from executing at the Gateway, with endpoint blocking planned for a later stage. A policy then prevents the agent from relaunching on the targeted host or host group, and the tool blocks its access to the enterprise network. Each action is recorded in an audit trail.

The feature builds on Falcon Guardian’s monitoring of what an agent is told to do, what it communicates, and what it executes. The platform can identify approved and shadow AI agents, track their tasks and file access, control access, detect prompt injection attacks, and investigate suspicious behavior.

CEO and founder George Kurtz said the feature would put people in control of AI safety. CrowdStrike is not alone in developing controls for AI agents: the source also names products from Straiker, JetStream Security, Trust3 AI, Microsoft, Palo Alto Networks, and Cisco.