Key points
- CrowdStrike's AI Kill Switch targets agents, not models
- Where CrowdStrike's switch stops agents first
- CrowdStrike's two AI startup deals reportedly total $495 million
CrowdStrike (CRWD) launched an AI Kill Switch on Tuesday that it says lets security teams stop a misbehaving AI agent, prevent it from restarting, and cut off its network access.
The tool is part of Falcon Guardian, CrowdStrike's product for securing AI agents, and is available now, the company said in its announcement at its Fal.Con Europe conference in Barcelona. An authorized administrator triggers each action, and each one is recorded in an audit trail.
CrowdStrike also agreed to buy two startups that monitor and test AI agents, Fiddler AI and Dreadnode. Its shares were up 2.6% at $247.98 as of 10:45 a.m. ET.
The switch works on agents, not models
An AI agent is software that uses a model to take actions, such as running code or sending messages. CrowdStrike says its switch stops the agent and cuts off its network access; its release does not describe shutting down the underlying model.
The term "AI kill switch" can refer to several different controls, as we explained in September: shutting down a model, cutting off an agent's tools, or disconnecting the hardware a model runs on.
Chief Executive George Kurtz wrote in a post on X that CrowdStrike's switch "lives outside the model, at runtime, where an agent can't argue with it, rewrite it, or wait it out."
The kill switch starts at the gateway
The release says the Falcon sensor stops the agent "first at the Gateway, and soon on the endpoint." An endpoint is the computer or server where the agent runs. The release doesn't say when stopping agents on the endpoint will be available.
Another line in the same release says the kill switch "starts on the endpoint, where the Falcon sensor already operates." The release doesn't explain how the two lines fit together.
CrowdStrike is buying two AI security startups
Fiddler AI tracks what AI agents do and explains why they made their decisions. Kurtz called it "the flight recorder for every agent" in the Fiddler announcement. CrowdStrike plans to sell the technology as Falcon Observe.
Dreadnode tests AI models and agents for weaknesses before companies put them to work. Its software runs more than 100 known AI attack strategies, including jailbreaks and prompt injection, according to the Dreadnode announcement. Its findings will feed Falcon Guardian as policy recommendations, and its team will join CrowdStrike's Cyber Superintelligence Lab.
CrowdStrike didn't disclose prices. It said it will pay mostly in cash, with some stock subject to vesting conditions. The Wall Street Journal reported that CrowdStrike is paying about $400 million for Fiddler and about $95 million for Dreadnode, $495 million in total, according to SecurityWeek.
Both deals are expected to close in CrowdStrike's fiscal fourth quarter, which ends January 31, 2027. CrowdStrike expects Falcon Observe and Dreadnode's testing product to be generally available in the same quarter.
California is writing its own kill switch rules
The launch comes as California works on rules for a different kind of kill switch. On September 18, Governor Gavin Newsom signed an executive order giving an expert panel two months to recommend changes to the state's AI safety laws.
The order asks the state to "[a]dvance the creation of a 'kill switch' for frontier models," with the switch's effectiveness checked by an independent organization. CrowdStrike is selling a product under the same name California's order uses, but the two describe different controls. CrowdStrike's switch stops agents on a company's own systems, while the order asks for one for the most advanced AI models.
