CrowdStrike Announces Falcon Features to Detect and Respond to AI Agent Threats
Summary
CrowdStrike announced Falcon capabilities for detecting unusual AI agent behavior, investigating whether actions came from an agent or its user, and coordinating response and approval controls. Several features are listed for Q4; others are generally available or in bet
Key points
- CrowdStrike says Falcon Next-Gen SIEM will baseline AI agents’ behavior, including the files they access, tools they call, and where they send data, and flag deviations even when granted permissions are not violated.
- Dynamic Risk Scoring, listed for Q4, combines agent, owner, and host risk in a 0–100 score.
- AI Ecosystem Detections, listed for Q4, target LLM API abuse, stolen API keys, and compromises involving coding assistants, MCP servers, and agent frameworks.
- Multi-Agent Triage and Investigation is generally available; CrowdStrike says it can trace agent activity to the user’s request and investigate across endpoint, identity, and agent context.
- The generally available Unified Agentic SOAR Experience coordinates response actions, including stopping an agent and cutting off its access; the company says it can govern actions requiring approval.
- Human-in-the-Loop Action Requests can pause agents before sensitive tool use. Other announced controls include policy-drift guardrails in beta and Q4 features for workflow approvals and agent credit controls.
Article Details
- Event Type
- CrowdStrike announced agentic SOC capabilities for detecting, investigating, and responding to AI agent insider threats.
- Impact
- The announced capabilities are intended to identify compromised or policy-drifting agents by correlating agent, user, and host activity, then support investigation and response actions such as pausing agents or revoking access. Availability varies: some features are generally available, while others are in beta or planned for Q4; the article notes that unreleased features remain in development and may change.
Vendors
Products
AgentWorksAgent Guardrails, powered by Falcon Guardian (Beta, Q4), screen every CrowdStrike Charlotte AI™ and AgentWorks interaction for policy drift, unauthorized tool calls, and out-of-bounds data access to catch theCrowdStrike Charlotte AIPolicy-Drift Agent Guardrails, powered by Falcon Guardian (Beta, Q4), screen every CrowdStrike Charlotte AI™ and AgentWorks interaction for policy drift, unauthorized tool calls, and out-of-bounds data access to catchCrowdStrike FalconToday, CrowdStrike is advancing the agentic SOC to do both through the CrowdStrike Falcon® platform so teams can secure the agents running in their environment and put expert agents to work inside the SOC to investigate