CrowdStrike Launches an AI Kill Switch to Stop AI Agents That Step Out of Line
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
CrowdStrike is adding a switch to Falcon Guardian that lets an authorized administrator bring a misbehaving AI agent to a sudden halt, without deleting its code. Falcon works at the Gateway for now and will reach the endpoint later; the agent also cannot start again on those machines and loses its network. CrowdStrike has not given a price, and every order is logged so it can be audited.
CrowdStrike has unveiled the AI Kill Switch, a new feature in Falcon Guardian, the company's product for protecting the AI agents that businesses run. It made the announcement on November 3 at its Fal.Con Europe conference in Barcelona, and its press release says the feature has been available since that day. With it, a security team can halt an agent that behaves outside what was planned, stop it from starting up again on the affected machine or group of machines, and take away its access to the company network.
The announcement walks through the steps. To begin with, the Falcon sensor halts the agent at the Gateway; later on it will also do so at the endpoint, meaning the computer or server the agent runs on. A Falcon Guardian policy prevents a relaunch, and the agent is left with no connection to the corporate network. The action is set off by an authorized administrator, and each step is written to the audit log. The same text warns that it covers features not yet released, which may change.
Falcon Guardian could already find the agents operating inside a company, apply rules on what they are allowed to do and spot attacks aimed at them. CNBC reports that Guardian came out in September, and CrowdStrike told the outlet that the switch leaves the agent's code in place: it uses the connected AI gateways to cut the agent off from the models that steer its decisions. The system picks up the activity, but a person makes the call to disconnect the agent and to give its access back.
George Kurtz, CrowdStrike's chief executive and founder, sums it up in the release: "When you deploy agents with a kill switch, you stay in control." Chief business officer Daniel Bernard likened the switch to a circuit breaker in comments to CNBC, and Rick Orloff, head of security at Everpure, notes in the release that it runs on the Falcon sensor Everpure already had.
Neither the release nor CNBC gives a price. According to CNBC, CrowdStrike also announced on the same day an integration with Anthropic's Claude Cowork and its plans to buy Fiddler AI and Dreadnode, a company that tests the security of AI.
Why it matters · analysis and opinion
Until now, the conversation about AI agents at work has revolved around what they can do; this launch shifts the focus to how they are stopped. A security vendor turning shutdown into a named feature reflects the idea CrowdStrike repeats in its announcement: companies will only give their agents more room if they know they can rein them in. Being able to cut one off in time will matter as much as being able to deploy it. Even so, stopping the agent on the machine itself has not arrived yet, and the feature only serves those already working with Falcon. For everyone else, the lesson is practical: before letting loose an agent with access to real systems, it pays to be clear about who can stop it, how its access is withdrawn and where a record of what it did is kept.
Official source: CrowdStrike · Written with the help of AI: how we make the news
