Briefs
CrowdStrike adds a kill switch for rogue AI agents
CrowdStrike unveiled an "AI Kill Switch" inside Falcon Guardian on Monday, letting a human security administrator terminate a misbehaving AI agent, block it from relaunching, and cut its network access.
The feature, announced at Fal.Con Europe 2026 in Barcelona, targets a problem CrowdStrike says enterprises face as they deploy AI agents with system-level access across endpoints, cloud, and SaaS: those agents chain together steps, run into obstacles, and can end up taking actions nobody authorized, even without any attacker involved. “AI safety is how you get the full benefit of AI. When you deploy agents with a kill switch, you stay in control,” said CEO and founder George Kurtz.
If an agent breaks from its intended behavior, the Kill Switch lets a security decision-maker shut it down at its root — starting at the Gateway today, with endpoint support coming soon — so teams can investigate without the agent continuing to run. Falcon Guardian policy then stops it from relaunching on the affected host or host group, and it loses its access to the enterprise network. CrowdStrike says an authorized administrator has to trigger the action, and every step is logged in an audit trail.
The feature extends Falcon Guardian, which already discovers the AI agents running inside a company, sets policy on what they’re allowed to do, and detects attacks aimed at them. Rick Orloff, CISO at Everpure, said the tool runs on the Falcon sensor his team already has in place: “If one goes off course, the AI Kill Switch gives our security team the final say… that’s what lets us say yes to more agents and more AI, faster.” The AI Kill Switch is available now.
Why it matters
As enterprises hand AI agents broader system access, CrowdStrike is betting that a visible, auditable shutoff mechanism — not just detection — is what convinces security teams to approve wider agent deployment.