CrowdStrike Unveils AI Kill Switch to Protect Against AI Agents

On November 3, 2026, the American company CrowdStrike introduced the AI Kill Switch, a tool designed to limit the actions of AI agents within corporate systems. This feature allows information security specialists to swiftly block autonomous programs' access to AI models upon detecting suspicious or unauthorized behavior.

The announcement was made at the Fal Con Europe 2026 conference in Barcelona. Simultaneously, CrowdStrike announced agreements to acquire Fiddler AI and Dreadnode, companies developing monitoring and security testing tools for artificial intelligence.

AI agents differ from regular chatbots by their ability to independently execute sequences of actions, interact with corporate applications, and process data. If improperly configured or if instructions are misinterpreted, such systems can perform operations that the user did not intend.

How the AI Kill Switch Works

The tool is available as part of the Falcon Guardian platform. Initially, the mechanism uses special AI gateways through which requests to models are routed.

Upon detecting unwanted activity, an administrator can activate the AI Kill Switch, after which the connected gateway blocks the selected agent's access to the utilized model. This limits further execution of tasks dependent on AI interaction.

The feature supports CrowdStrike's own Falcon AI Gateway solution as well as compatible third-party gateways.

In the future, the company plans to expand the capabilities of the AI Kill Switch. Planned features include directly terminating AI agent processes on computers and servers, preventing their restart, and restricting access to corporate resources.

CrowdStrike also intends to coordinate protective actions among local devices, cloud services, browsers, and corporate applications. The launch dates for these additional capabilities have not yet been announced.

In addition to the new blocking mechanism, CrowdStrike has expanded Falcon Guardian's functions to check AI agent instructions. The platform supports request control in Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, Cursor, and OpenCode.

To detect suspicious instructions, the company uses SafeMind models. These are designed to identify attempts to manipulate AI behavior, including instruction substitution in processed data.

CrowdStrike to Allocate Around $495 Million for Two Companies

Alongside the launch of the AI Kill Switch, CrowdStrike has entered into agreements to purchase Fiddler AI and Dreadnode. According to The Wall Street Journal, the total acquisition cost is estimated at approximately $495 million, with about $400 million for Fiddler AI and $95 million for Dreadnode. CrowdStrike itself did not disclose the deal prices.

Fiddler AI specializes in monitoring the behavior of autonomous systems. Its technologies allow tracking of agent action sequences, interactions with external tools, and the reasons behind decisions made.

CrowdStrike plans to use these developments in the Falcon Observe product. It aims to help companies analyze AI agent operations before deployment and after launch, identify deviations from assigned tasks, and retain data for incident review.

Dreadnode develops automated security testing tools for AI models, applications, and agents. Its software checks systems for vulnerabilities, including the possibility of bypassing restrictions and executing malicious instructions.

After integration, Dreadnode's technology is expected to be used for testing AI systems before their implementation, with test results used to enhance Falcon Guardian's protection rules.

CrowdStrike expects to complete both deals in the fourth quarter of the 2027 fiscal year, ending January 31, 2027. The availability of Falcon Observe and new testing tools is also anticipated during this period.