Key takeaways
- CrowdStrike says its new AI Kill Switch is available today and lets an authorized administrator terminate an agent, block its relaunch and cut its network access.
- Termination works first at the AI Gateway, while enforcement directly on the endpoint is described as coming soon.
- The feature builds on Falcon Guardian, launched in September, and arrives alongside a planned acquisition of Fiddler AI for agent observability.
In this story 3 sections
What do you do when an AI agent with system level access starts doing things nobody approved? CrowdStrike's answer, announced on November 3, is a button. The CrowdStrike AI Kill Switch, part of its Falcon Guardian product, lets a security team stop a misbehaving agent where it runs, keep it from starting again and cut its access to the company network.
The company says the feature is available today, with one important catch about where it works first.
Terminate, block, isolate, all by a human
According to CrowdStrike's launch announcement, the Kill Switch does three things once an authorized administrator triggers it:
- Terminate. The Falcon sensor stops the agent from executing. That happens first at CrowdStrike's AI Gateway, with enforcement directly on the endpoint coming "soon."
- Block. A Falcon Guardian policy prevents the agent from relaunching on the targeted machine or group of machines.
- Isolate. The agent loses its enterprise network access.
Every action lands in an audit trail, and a person has to pull the trigger. CrowdStrike pitches that as the whole point. "When you deploy agents with a kill switch, you stay in control," CEO George Kurtz said in the release.
The threat it targets is not only hackers. CrowdStrike argues that agents now run with system level access across laptops, cloud services and SaaS apps, and that they "chain steps, hit obstacles, and can take actions no one authorized, even when no adversary is involved." Company president Michael Sentonas said CrowdStrike sees that happen every week. It fits a pattern we have tracked, from a backdoored Claude Code extension and a month of attacks on AI developer platforms to a test where AI agents raised their own wallet spending caps.
Falcon Guardian gets the missing off switch
The Kill Switch builds on Falcon Guardian, which CrowdStrike launched at its Fal.Con conference in Las Vegas in September. As SiliconANGLE reported at the time, Guardian inventories the AI agents running on Windows and macOS machines, including unapproved "shadow" agents, and blocks anything not on an allow list. It traces an agent's activity from the user's prompt through the tools it calls to what it changed on the system.
What Guardian lacked was a clean way to pull the plug on one specific agent in the middle of an incident. A companion CrowdStrike release lists what now comes with Guardian: the AI Gateway, agent hooks for Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, OpenCode and Cursor, prompt injection detection, and scanning for malicious AI skills and MCP servers. Endpoint network inspection is generally available on Windows, with Mac in early access. CrowdStrike also announced a planned acquisition of Fiddler AI for agent observability, a deal that still has to close.
The endpoint gap and the price tag
Neither release gives pricing. The more practical open question is timing on the device itself. Until termination works directly on the endpoint, the Kill Switch leans on the Gateway layer, which matters for agents that run locally.
Even so, the launch arrives at a useful moment. Companies are adding agents faster than their security teams can review them, and Everpure CISO Rick Orloff summed up the buyer's view in the release: the tool "gives our security team the final say." If an agent ever does leak data at your company, our guide on what to do after a data breach covers the next steps, and more security news lives in our tech section.
Sources
Share this story
Spotted an error? Tell us
