CrowdStrike Hackathon Highlights Five Principles for Security AI Agents
Summary
CrowdStrike and NVIDIA's AgentWorks Hackathon showcased agents for MCP-server discovery, MFA-reset abuse, and detection-rule testing. The article distills lessons on deterministic tools, guardrails, measurable outcomes, and trace-based optimization.
Key points
- CrowdStrike says the AgentWorks Hackathon received nearly 100 nominations from teams in more than 50 countries.
- An agent profiled in the article found 1,710 hosts running unapproved MCP servers at one company and flagged risky configurations.
- A Help Desk Takeover Defender agent investigates MFA resets using identity logs and Falcon telemetry; the article reports that investigations dropped from 20–30 minutes to about 70 seconds.
- The article recommends using deterministic tools for repeatable scoring and queries, while reserving model reasoning for tasks that need judgment.
- Highlighted safeguards include redacting sensitive data, limiting tool use, disclosing missing evidence, and requiring human approval for consequential actions.
- Agent traces can help identify ignored errors, empty results mistaken for no findings, excessive tool chaining, and unused knowledge bases; one builder reportedly cut a triage agent's cost about eightfold.
Article Details
- Topic
- Security AI agents: hackathon examples and design lessons for building governed, measurable security workflows
Vendors
CrowdStrikeThat’s why we built CrowdStrike® Charlotte AI™ AgentWorks: a no-code workspace that lets every security team build the exact agents they need, on the Falcon platform.NvidiaWorking with NVIDIA, we launched the first AgentWorks Hackathon and invited security teams to nominate agents they’ve built.
Products
Charlotte Agentic SOARCharlotte Agentic SOAR then passes that context into a new case for the governance team to review.Charlotte AI AgentWorksLearn more about Charlotte AI AgentWorks and start building on the Falcon platform.CrowdStrike Falcon Next-Gen SIEMIt takes output from CrowdStrike’s LogScale query assistant or the Falcon Next-Gen SIEM Correlation Rule Generation Agent and runs it through a fixed series of gates, including a check against a 196-function CrowdStrikeEntra IDIt pulls Entra ID logs and the supporting Falcon telemetry behind a reset, then scores the likelihood of a social engineering attack.FalconThat’s why we built CrowdStrike® Charlotte AI™ AgentWorks: a no-code workspace that lets every security team build the exact agents they need, on the Falcon platform.LogScaleIt takes output from CrowdStrike’s LogScale query assistant or the Falcon Next-Gen SIEM Correlation Rule Generation Agent and runs it through a fixed series of gates, including a check against a 196-function CrowdStrike
Tools
Agent Smith“Agent Smith”: Finding the MCP Servers Nobody Knew Were RunningDysfunctional Family-Tree AgentDysfunctional Family-Tree Agent: Most attacks today are malware-free.EASM Heartbeat AgentEASM Heartbeat Agent: An organization's external attack surface changes constantly.Exclusion Adversary“Exclusion Adversary” Agent: The Agent that Attacks its Own WorkHall Pass AgentHall Pass Agent: Security exemptions rarely expire on their own.Help Desk Takeover Defender“Help Desk Takeover Defender” Agent: Catching MFA Reset Abuse in 70 SecondsHOPSCOTCH AgentHOPSCOTCH Agent (Lateral Movement Flight Recorder): Tracing an identity or process across entry, internal hops, and exit points can be a time-consuming process.SneakerNet AgentSneakerNet Agent: The Falcon sensor records every file written to USB, far too many for any team to review by hand.TaHiTI Threat Hunting AgentTaHiTI Threat Hunting Agent: Structured threat hunting can take a senior analyst hours; most of it spent on research, schema lookups, query debugging, and write-ups rather than hunting.This is CQL AgentThis is CQL Agent: Security queries can run without errors but still fail.