cyber.hendryadrian.com
Security News · crowdstrike.com

CrowdStrike Agent Graph Links AI Agent Prompts to Endpoint Activity

· Original article ↗

Summary

CrowdStrike says Agent Graph connects AI-agent prompts, tools and sessions to endpoint processes, files and network activity in Falcon Guardian, with risk scoring and policy enforcement hooks for supported agents.

Key points

  • CrowdStrike describes Agent Graph as a layer in Falcon Guardian that links AI agents and their prompts, models and tools to endpoint activity observed by the Falcon sensor.
  • Its session graph traces prompts and tool calls to resulting processes, files and network connections.
  • In a vendor-provided example, an agent contacts an outside host, installs a package and runs an installer; CrowdStrike says Falcon Guardian blocks the process and quarantines the file.
  • The agent inventory is designed to show sanctioned and shadow agents across a fleet and their connected users, sessions, models and tools.
  • Falcon Guardian assigns agents threat scores from 0 to 100 to help teams prioritize review and inspect related sessions and detections.
  • For supported agents, hooks can capture prompts and tool-call inputs and outputs, and apply policy checks to stop a dangerous action before it runs.
  • CrowdStrike says hooks are available for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode and Cursor.

Article Details

Event Type
Product capability announcement
Impact
CrowdStrike describes Falcon Guardian and CrowdStrike Agent Graph as providing endpoint visibility into AI-agent prompts, tool calls, processes, files, and network connections. The company says agent hooks can enforce policy and stop dangerous actions before execution. The article describes product capabilities and examples, not a reported security incident.

Vendors

AnthropicCoding agents, desktop assistants, and command-line interface (CLI) agents from Anthropic, OpenAI, Cursor, and others sit side by side.CrowdStrikeThis is where attacks land, and where CrowdStrike Falcon® Guardian excels: on the endpoint, at runtime.CursorCoding agents, desktop assistants, and command-line interface (CLI) agents from Anthropic, OpenAI, Cursor, and others sit side by side.GitHubAgent hooks are available today for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode, and Cursor.OpenAICoding agents, desktop assistants, and command-line interface (CLI) agents from Anthropic, OpenAI, Cursor, and others sit side by side.

Products

Claude CodeA single Claude Code agent might have one user, three installs, eight tools, and 12 sessions.CrowdStrike Agent GraphTeams can use CrowdStrike Agent Graph to see not only what the agent was asked to do, but what it did.CrowdStrike Falcon GuardianWith Falcon Guardian, the same sensor also sees the AI layer: prompts, models, tools, and skills.Falcon sensorIt runs on the Falcon sensor businesses already have.GitHub CopilotAgent hooks are available today for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode, and Cursor.OpenAI CodexAgent hooks are available today for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode, and Cursor.OpenCodeAgent hooks are available today for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode, and Cursor.

Related Articles