CrowdStrike adds an AI Kill Switch to Falcon Guardian: stop a rogue agent at the Gateway, block its return

CrowdStrike announced the AI Kill Switch on November 3, 2026, as part of Falcon Guardian, its product for securing AI agents where they execute. If an agent breaks out of its intended behaviour, a defender can terminate it, block it from launching again, and cut off its enterprise network access. CrowdStrike frames it as the final human control over agents that enterprises have already given system-level access across endpoints, cloud services and software-as-a-service applications.

The case for it does not depend on an attacker. CrowdStrike says agents chain steps together, hit obstacles, and can take actions nobody authorized even when no adversary is involved. That is the failure mode the kill switch is built for: software a business deployed on purpose, doing something it was not supposed to do, at machine speed, while a security team is still working out what happened.

How the kill switch works

CrowdStrike describes four linked actions. The Falcon sensor stops the agent from executing, first at the Gateway and soon on the endpoint, so a malicious or misbehaving agent does not keep running while teams investigate. Falcon Guardian policy then keeps the agent from relaunching on the targeted host or host group. The agent loses its enterprise network access. And the whole intervention stays human: an authorized administrator triggers it, and every action is recorded in the audit trail.

The sensor is doing more than watching one layer. Falcon Guardian already sees what an agent is told to do, what it communicates and what it executes, CrowdStrike says, because it connects agent-level controls, endpoint network inspection and the endpoint itself on a single Falcon sensor. The kill switch sits on top of that existing visibility: Guardian already discovers the AI agents running in an enterprise, enforces policy on what they can do, and detects attacks against them.

Gateway first — the endpoint stop is still to come

The rollout wording matters, and CrowdStrike states it plainly in both releases: termination happens “first at the Gateway, and soon on the endpoint.” The kill switch itself is available today, but buyers should not read the announcement as promising direct endpoint termination already. That part is described as coming later, and the release carries the usual caution that unreleased features are still in development and subject to change.

That distinction is worth keeping in mind because of where agents actually run. An agent that executes on the endpoint, including one running a local or open-weight model that never touches the network, cannot be stopped by watching traffic alone, CrowdStrike argues in its wider Falcon Guardian announcement the same day. The Gateway stop closes the networked path now; the endpoint stop, when it arrives, is the part that ends execution where the agent runs.

Part of a wider Guardian update

The kill switch did not arrive alone. In the same announcement CrowdStrike said the AI Gateway is now generally available and included with Guardian, routing AI traffic through a central gateway to inspect prompts and responses, monitor usage and enforce policy across managed and unmanaged devices. Agent-level hooks now enforce policy inside Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, OpenCode and Cursor, inspecting prompts and blocking malicious activity at the source. SafeMind-powered detection targets attacks on AI systems, including prompt injection, malicious instructions and personally identifiable information, and AI supply chain protection looks for malicious AI skills and MCP servers before they enter the environment.

There is also an Anthropic integration: the Falcon sensor can run inside the Claude Cowork virtual machine, in partnership with Anthropic, to gain visibility inside the Cowork environment. Endpoint network inspection, which pairs what an agent sends over the network with what it does on the endpoint, is generally available for Windows, with Mac in early access. And CrowdStrike said it intends to acquire Fiddler AI, a company focused on AI agent observability, to add the ability to evaluate agents before they deploy and explain why they act. No terms for that planned acquisition were disclosed in the announcement.

What it is not

Despite the name, this is not a universal off button for artificial intelligence. It is a control inside CrowdStrike’s enterprise security environment, triggered by an authorized human, for agents running under Falcon Guardian. A kill switch also does not undo what an agent already did: stopping the agent, blocking its return and logging the intervention are containment, not reversal. And a control that exists does not by itself prove every harmful action will be caught before it has consequences — a point independent coverage of the announcement also stressed, alongside the Gateway-first rollout detail.

Read that way, the announcement is less dramatic than its name and more useful for it. CrowdStrike chief executive George Kurtz put the pitch in one line: “AI safety is how you get the full benefit of AI. When you deploy agents with a kill switch, you stay in control.” Rick Orloff, chief information security officer at Everpure, gave the customer version: “We want our teams to use AI agents. If one goes off course, the AI Kill Switch gives our security team the final say.” The test now is the part CrowdStrike has not shipped yet: the endpoint stop, and whether teams reach for the switch fast enough when an agent goes off course.