CrowdStrike adds AI agent kill switch and plans Fiddler AI deal

CrowdStrike describes Falcon Guardian as combining agent-level controls, endpoint network inspection and the endpoint on a single Falcon sensor.[1] Its agent-level hooks enforce policy inside named AI agents, including Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, OpenCode and Cursor.[1] The Kill Switch adds a response for unauthorized agents: CrowdStrike says it can terminate them in real time at the gateway initially, and is intended to block them from running again across the organization.[2] Endpoint-based termination is planned for a later stage.[1]

CrowdStrike says Falcon Guardian has been generally available since September 2026.[1] Its AI Gateway is also generally available and included with Guardian.[1] The gateway routes AI traffic through a centralized point to inspect prompts and responses, monitor usage and enforce policy across managed and unmanaged devices.[1] Endpoint Network Inspection is generally available for Windows, while the Mac version is in early access, according to CrowdStrike.[2] These distinctions matter to teams assessing which controls they can use now and which remain limited or planned.

CrowdStrike says its planned Fiddler AI acquisition would add capabilities to evaluate agents before deployment, and describes Fiddler as a leader in AI-agent observability.[2][1] The company has not disclosed acquisition terms and says the deal remains subject to closing conditions.[2] The Wall Street Journal reported that CrowdStrike agreed to acquire two AI-security startups for a combined $495 million and would pay roughly $400 million for Fiddler AI; it also reported that most of the purchase price would be cash, with some stock subject to vesting conditions.[3] CyberScoop reported the acquisitions were expected to close in that quarter, pending standard approval steps.[4]

CrowdStrike also announced AI Supply Chain Protection to detect malicious AI skills and MCP servers, and an integration to run its Falcon sensor inside the Claude Cowork virtual machine.[2] It described a planned Guardian expansion to cover cloud workloads, SaaS and cloud agent frameworks, including AWS AgentCore.[2] CyberScoop reported that Fiddler’s technology can trace agent decisions and reasoning, flag drifting behavior and made-up answers, and create records for audits.[4] CrowdStrike’s stated position is that one control point is insufficient and that control requires the agent, network and endpoint together.[1]