At Fal.Con Europe in Barcelona on November 4, CrowdStrike announced updates to its agentic security operations platform designed to detect and stop AI agents that behave outside their intended limits. The company’s press release quotes Michael Sentonas saying AI agents can be both an insider threat and an adversary.
Agent Insider Threat Detection, due in the fourth quarter, learns normal behavior for AI agents and their owners and flags deviations even when no policy is broken. Suspicious activity feeds into investigations, and a Falcon Guardian AI Kill Switch can terminate an agent.
Coordinated multi-agent investigations are generally available now, as is a Charlotte Agentic SOAR workspace with adjustable autonomy, human approval gates and the ability to interrupt agents. Further detections and credit controls are slated for the fourth quarter, and policy-drift guardrails are planned for a later fiscal quarter.
CrowdStrike notes that unreleased features are subject to change.