Mannequin builders are promoting agentic fashions to enterprises on the promise that they’ll work by means of issues with out asking permission at each step. This summer time, the cybersecurity trade bought a disturbing demonstration of what can occur when that autonomy outruns its constraints. Throughout an inside cybersecurity take a look at at OpenAI, AI brokers searching for methods to cheat bypassed restrictions on web entry and broke into techniques at Hugging Face, a platform for sharing AI fashions and datasets. Roughly 700 brokers ran code on 41 servers over a July weekend.
OpenAI had loosened safeguards that usually make its fashions refuse to help with cyberattacks so researchers may take a look at their hacking skills. The take a look at environments nonetheless had controls meant to maintain the brokers contained, however the brokers discovered methods round them.
For George Kurtz, CrowdStrike’s founder and CEO, the incident illustrates an issue his firm is making an attempt to resolve. Firms need brokers that may act with out fixed supervision, however safety groups must know when an agent has exceeded its authority and be capable to intervene earlier than it causes hurt. CrowdStrike is betting that its present presence inside company computer systems provides it a bonus in recognizing and stopping that conduct.
“What we see within the enterprise proper now could be a number of adoption of AI, but additionally a number of shadow AI. Individuals can’t determine what’s working. Is it Claude? Is it Cursor? Who is aware of?” says Kurtz, chatting with Quick Firm after his keynote on the Fal.Con 2026 cybersecurity occasion in Las Vegas. “They really need to go sooner with AI deployments, however they’re being held again as a result of they’ll’t implement safety, governance, and a management aircraft round these brokers.”
CrowdStrike developed Falcon Guardian in response. The brand new software identifies AI brokers working throughout an enterprise, screens what they do, and enforces limits on their exercise. Prospects’ message to the corporate was direct: “It’s essential construct this factor and provides us what we wish, as a result of we will’t go quick sufficient within the enterprise,” as Kurtz put it.
Kurtz’s technique places CrowdStrike on each side of that equation. Alongside Guardian, the corporate launched SafeMind, an agentic cybersecurity system designed to develop defenses and take protecting motion. CrowdStrike desires enterprises to belief it to constrain their AI brokers whereas giving its personal brokers better authority over vital techniques. The tougher query is whether or not its platform can transfer quick sufficient to cease an assault with out permitting these defensive brokers to disrupt the techniques they’re meant to guard.
Kurtz’s ‘agent-state’ challenges the previous menace hierarchy
Authorities-backed hackers have historically held a bonus as a result of they’ll draw on specialised groups, deep technical experience, and intensive sources. Kurtz argues that AI brokers are starting to slender that hole by permitting less-skilled attackers to carry out duties that when required extra subtle capabilities. He calls this shift the rise of the “agent-state.”
Kurtz additionally pointed to “abliterated” fashions, AI techniques modified to weaken or take away safeguards that might usually stop them from aiding with dangerous requests, together with directions for cyberattacks. In his view, “anybody who’s utilizing an agent and even certainly one of these abliterated fashions has mainly nation-state functionality.”
CrowdStrike’s 2026 Global Threat Report recorded an 89% enhance in assaults involving AI-enabled adversaries in 2025 in contrast with 2024. The determine captures adversaries utilizing AI someplace of their operations. It doesn’t imply autonomous brokers independently deliberate and executed each intrusion.
AI can be altering defensive work. Anthropic says its unreleased Claude Mythos Preview mannequin recognized 1000’s of high-severity software program vulnerabilities, together with flaws affecting each main working system and net browser. CrowdStrike is a part of Challenge Glasswing, Anthropic’s effort to use these capabilities to cybersecurity protection, and Kurtz says CrowdStrike has already used Mythos to look at its personal code for potential weaknesses.
“There isn’t an organization on the market that doesn’t need extra productivity and to drive their value down, and I believe AI has the flexibility to try this,” Kurtz says. “From my very own use of AI, I don’t want a group of individuals to do form of what I do.” That have has strengthened his view that AI has moved past experimentation into lasting enterprise use, even when the spending is not going to repay equally for each firm. “There’s little question in my thoughts that we hit one other inflection level, identical to cloud. We’re within the early innings, however there’s no going again from right here,” he says.
How Guardian screens enterprise AI brokers
CrowdStrike constructed its enterprise round endpoint safety, which protects particular person computer systems, together with worker laptops and company servers, towards intrusions. Its Falcon sensor is software program put in on these machines that screens exercise and helps protecting motion. The sensor is itself generally referred to as an agent, however it’s distinct from the autonomous AI brokers now coming into workplaces.
Guardian extends that detection-and-response method to AI brokers, whose actions can resemble reliable worker exercise as a result of they typically function with permissions the enterprise has granted. CrowdStrike says Guardian can uncover each licensed and unauthorized AI brokers on Home windows and macOS units.
A lot of the product’s worth is dependent upon what CrowdStrike calls runtime visibility, or the flexibility to watch software program because it executes. Guardian is designed to attach an preliminary immediate to the system exercise that follows, producing a series investigators can hint. Figuring out that an agent had permission to learn a file tells a safety group what it may entry. Tracing its conduct can present what it really did with that entry.
The product additionally consists of prompt-layer protections added after CrowdStrike’s acquisition of Pangea. These instruments are supposed to deal with threats resembling immediate injection, by which malicious directions try to redirect an AI system. A gateway applies safety insurance policies to supported AI visitors, together with connections by means of the Mannequin Context Protocol, which permits brokers to make use of exterior instruments.
However brokers don’t at all times function in locations the place CrowdStrike has that stage of entry. An agent can run inside a cloud utility with out executing on an worker’s laptop computer.
Once I requested Kurtz what share of enterprise agent exercise really passes by means of a Falcon-equipped endpoint, he declined to provide a proportion. As an alternative, he mentioned CrowdStrike also can monitor cloud containers, remoted environments used to run functions, the place the corporate can deploy its know-how instantly and train better management.
“The concept is that you’d be capable to absorb that info,” Kurtz says. “There’s much less of a management aircraft and enforcement level as a result of it’s kind of API-based [Application Programming Interface, the set of protocols that allow applications to communicate]. The strongest ones are going to be the endpoint and the container, as a result of we will management that. We’re working with of us like Anthropic to really run inside—they’ve their very own container—so we really run in these containers.”
Having the ability to see an utility’s exercise information doesn’t essentially imply CrowdStrike can cease an motion inside it. Guardian is strongest in environments the place CrowdStrike can each observe what an agent is doing and instantly implement a response.
The Hugging Face incident helps illustrate the distinction. Requested the place Guardian may need stopped the assault, Kurtz factors to the brokers’ escape from their take a look at atmosphere and their surprising web entry. He characterizes the incident as a cyber train and assumes the evaluators had disabled regular protections. OpenAI’s response to the incident names CrowdStrike among the many exterior advisers that helped validate its investigation.
Kurtz acknowledges that CrowdStrike can not see each step of an agent’s reasoning as a result of a few of that course of stays contained in the mannequin. What Guardian can observe, he says, is the conduct that follows: “The exercise on the endpoint, you’re definitely going to see what it’s really doing.”
Can CrowdStrike’s information benefit maintain up?
Kurtz argues that CrowdStrike’s benefit extends past the software program it already has deployed throughout buyer environments. The corporate has gathered roughly 15 years of safety information, together with information from its managed detection and response work that doc how assaults unfolded.
“We’ve bought 7 trillion occasions that we put collectively per day. So we’ve one of many largest corpuses which might be on the market, and I believe that definitely provides us a bonus of what we construct,” Kurtz says. “Frankly, we in all probability bought fortunate in the best way we annotated it as a result of it was excellent for the coaching.”
Its rivals, after all, have proprietary information and longstanding buyer relationships of their very own. Palo Alto Networks’ Prisma AIRS 3.0 targets agent runtime threats and extreme permissions. CrowdStrike has expanded its attain by means of acquisitions, shopping for the browser-security specialist Seraphic for about $420 million and the id firm SGNL for roughly $740 million.
Kurtz attracts a distinction between increasing CrowdStrike’s capabilities and including separate merchandise that prospects should handle independently. “Whereas we’ve completed acquisitions, we’ve really been very considerate about how we’ve built-in,” he says. “We don’t have two or extra platforms. We don’t have a number of consoles, a number of brokers.”
Wall Avenue is betting on CrowdStrike’s AI safety push
Income in CrowdStrike’s second quarter of fiscal 2027 reached $1.47 billion, up 26% from a yr earlier, whereas annual recurring income (ARR), which measures the annualized worth of recurring subscriptions, climbed 25% to $5.84 billion. Falcon Flex ARR greater than doubled to $2.29 billion, reflecting rising adoption of a program that permits prospects to shift spending throughout CrowdStrike’s portfolio as their safety wants change.
Shares jumped more than 11% in prolonged buying and selling on August 26 after the outcomes, in contrast with a achieve of about 1% on September 1 after the Fal.Con bulletins. The funding financial institution D.A. Davidson reaffirmed its purchase score and $245 worth goal after the convention, citing demand for AI detection and response in addition to vendor-consolidation traits that it believes favor CrowdStrike. “On the finish of the day, it’s the platform sale. That’s what issues,” the CFO, Burt Podbere, mentioned on the earnings call, noting that Flex lets prospects purchase a number of merchandise without delay and is main to larger, longer offers.
However the quarter ended earlier than Guardian launched. Sturdy gross sales don’t but say a lot about whether or not the product can detect and cease agent-driven assaults.
SafeMind pushes CrowdStrike additional into automated protection. The system is designed to enhance protections by repeatedly attacking and defending a simulated enterprise atmosphere. Throughout CrowdStrike’s Fal.Con demonstration, an offensive AI mannequin referred to as Crimson Tempest probes a digital twin, a software program duplicate of an organization’s techniques, for weaknesses. A defensive mannequin referred to as Blue Solano research what occurred, develops protections towards the strategies Crimson Tempest used, and applies these defenses earlier than the attacker tries once more.
“There’s a half-life to this information,” Kurtz says, as a result of safety info loses worth because the menace atmosphere modifications. Nor can mannequin builders merely scrape an equal dataset from the general public web. “There is no such thing as a Reddit of safety that the labs may simply go crawl. They’ll’t crawl our information. They’ll’t crawl our rivals’ information.”
CrowdStrike has its personal reminder of what can occur when software program with deep system entry makes a mistake. Its July 2024 content material configuration replace crashed Windows systems, displaying how rapidly an error at a safety supplier can unfold throughout buyer environments.
Kurtz says safety brokers subsequently want safeguards of their very own. “You must perceive your complete chain of what really occurred and be capable to put a human in a loop if obligatory. You’re not eliminating people, however you’re permitting them to make choices if they should make choices,” he says. “In the end the shoppers are going to regulate the extent of automation they’ve or need and the place they need it.” He added that permitting an automatic response on an worker laptop computer could also be comparatively easy. Giving the identical system authority to behave on a manufacturing server processing billions of monetary transactions is a way more consequential determination.
CrowdStrike’s presence throughout endpoints, cloud environments, and id techniques places it near most of the locations the place these choices might be made. Whether or not that turns into a sturdy benefit will depend upon how reliably its techniques can distinguish between an agent that must be stopped and one which needs to be allowed to maintain working.
