CrowdStrike has introduced an AI agent kill switch designed to stop unauthorized activity inside corporate networks, alongside plans to acquire AI observability startup Fiddler as businesses give increasingly autonomous software access to their systems.
The cybersecurity company announced the launch Tuesday at its Fal.Con Europe 2026 conference in Barcelona, expanding its Falcon Guardian security platform with controls that let administrators intervene when AI agents stray beyond their assigned tasks.
The move tackles a problem companies face as they deploy AI systems capable of executing code, accessing sensitive information, and interacting with business applications. Unlike conventional chatbots, these agents can perform sequences of actions with limited human oversight, potentially causing damage even when nobody has deliberately attacked them.
In practice, an agent authorized to organize corporate files might misinterpret its instructions, follow malicious directions embedded in a document, or execute a command its operator never intended. The same access that makes autonomous agents useful can also make their mistakes expensive.
How CrowdStrike's AI kill switch works
The new AI Kill Switch gives security administrators a way to interrupt an agent's activity without waiting for it to complete its task. According to CrowdStrike's technical explanation, the currently available mechanism works through AI gateways, which can block an agent's access to the models powering its decisions.
The initial release does not yet provide every type of containment CrowdStrike has described. The company plans to expand the feature to terminate agent processes directly on endpoints and coordinate restrictions across cloud environments and other enterprise systems.
An authorized administrator triggers the kill switch, and the action is recorded in an audit trail. CrowdStrike also describes controls to prevent terminated agents from restarting and restrict their network access, with broader enforcement capabilities still under development.
The company is adding protections at other points where agents operate. Falcon Guardian can inspect agent prompts and apply policies to tools including Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, Cursor, and OpenCode.
The risk is already well documented. As Decrypt previously reported, Microsoft researchers identified a vulnerability in Anthropic's Claude Code GitHub Action that could have allowed attackers to manipulate the coding agent into exposing sensitive credentials through malicious repository content. Anthropic subsequently patched the flaw but Crowdstrike’s solution would be more extensive.
Fiddler acquisition adds visibility into agent decisions
CrowdStrike also signed an agreement to acquire Fiddler AI, a company specializing in monitoring AI models and explaining their behavior.
The deal values Fiddler at roughly $400 million, according to The Wall Street Journal. CrowdStrike has not publicly disclosed the acquisition price, although it said the transaction would be paid primarily in cash, with some stock subject to vesting conditions.
Fiddler's technology addresses a related problem that a kill switch alone cannot solve: understanding what an AI agent was doing before something went wrong, and whether its actions were appropriate in the first place.
Its software evaluates agents before deployment, traces their decisions and tool calls, and monitors changes in behavior after they begin operating. These records can help security teams investigate unexpected actions or provide evidence to auditors.
CrowdStrike expects to complete the Fiddler acquisition during the fourth quarter of fiscal 2027, which ends January 31, 2027, subject to customary closing conditions. Its expanded endpoint kill-switch capabilities have not yet received a specific release date.
