Model developers are selling agentic models to enterprises on the promise that they can work through problems without asking permission at every step. This summer, the cybersecurity industry got a disturbing demonstration of what can happen when that autonomy outruns its constraints. During an internal cybersecurity test at OpenAI, AI agents looking for ways to cheat bypassed restrictions on internet access and broke into systems at Hugging Face, a platform for sharing AI models and datasets. Roughly 700 agents ran code on 41 servers over a July weekend.
OpenAI had loosened safeguards that normally make its models refuse to assist with cyberattacks so researchers could test their hacking abilities. The test environments still had controls meant to keep the agents contained, but the agents found ways around them.
For George Kurtz, CrowdStrike’s founder and CEO, the incident illustrates a problem his company is trying to solve. Companies want agents that can act without constant supervision, but security teams need to know when an agent has exceeded its authority and be able to intervene before it causes harm. CrowdStrike is betting that its existing presence inside corporate computers gives it an advantage in spotting and stopping that behavior.
“What we see in the enterprise right now is a lot of adoption of AI, but also a lot of shadow AI. People can’t figure out what’s running. Is it Claude? Is it Cursor? Who knows?” says Kurtz, speaking to Fast Company after his keynote at the Fal.Con 2026 cybersecurity event in Las Vegas. “They actually want to go faster with AI deployments, but they’re being held back because they can’t implement security, governance, and a control plane around these agents.”
CrowdStrike developed Falcon Guardian in response. The new tool identifies AI agents operating across an enterprise, monitors what they do, and enforces limits on their activity. Customers’ message to the company was direct: “You need to build this thing and give us what we want, because we can’t go fast enough in the business,” as Kurtz put it.
Kurtz’s strategy puts CrowdStrike on both sides of that equation. Alongside Guardian, the company introduced SafeMind, an agentic cybersecurity system designed to develop defenses and take protective action. CrowdStrike wants enterprises to trust it to constrain their AI agents while giving its own agents greater authority over critical systems. The harder question is whether its platform can move fast enough to stop an attack without allowing those defensive agents to disrupt the systems they are meant to protect.
Kurtz’s ‘agent-state’ challenges the old threat hierarchy
Government-backed hackers have traditionally held an advantage because they can draw on specialized teams, deep technical expertise, and extensive resources. Kurtz argues that AI agents are beginning to narrow that gap by allowing less-skilled attackers to perform tasks that once required more sophisticated capabilities. He calls this shift the rise of the “agent-state.”
Kurtz also pointed to “abliterated” models, AI systems modified to weaken or remove safeguards that would normally prevent them from assisting with harmful requests, including instructions for cyberattacks. In his view, “anyone who’s using an agent or even one of these abliterated models has basically nation-state capability.”
CrowdStrike’s 2026 Global Threat Report recorded an 89% increase in attacks involving AI-enabled adversaries in 2025 compared with 2024. The figure captures adversaries using AI somewhere in their operations. It does not mean autonomous agents independently planned and executed every intrusion.
AI is also changing defensive work. Anthropic says its unreleased Claude Mythos Preview model identified thousands of high-severity software vulnerabilities, including flaws affecting every major operating system and web browser. CrowdStrike is part of Project Glasswing, Anthropic’s effort to apply those capabilities to cybersecurity defense, and Kurtz says CrowdStrike has already used Mythos to examine its own code for potential weaknesses.
“There isn’t a company out there that doesn’t want additional productivity and to drive their cost down, and I think AI has the ability to do that,” Kurtz says. “From my own use of AI, I don’t need a team of people to do kind of what I do.” That experience has reinforced his view that AI has moved beyond experimentation into lasting business use, even if the spending will not pay off equally for every company. “There’s no doubt in my mind that we hit another inflection point, just like cloud. We’re in the early innings, but there’s no going back from here,” he says.
How Guardian monitors enterprise AI agents
CrowdStrike built its business around endpoint security, which protects individual computers, including employee laptops and corporate servers, against intrusions. Its Falcon sensor is software installed on those machines that monitors activity and supports protective action. The sensor is itself sometimes called an agent, but it is distinct from the autonomous AI agents now entering workplaces.
Guardian extends that detection-and-response approach to AI agents, whose actions can resemble legitimate employee activity because they often operate with permissions the business has granted. CrowdStrike says Guardian can discover both authorized and unauthorized AI agents on Windows and macOS devices.
Much of the product’s value depends on what CrowdStrike calls runtime visibility, or the ability to observe software as it executes. Guardian is designed to connect an initial prompt to the system activity that follows, producing a chain investigators can trace. Knowing that an agent had permission to read a file tells a security team what it could access. Tracing its behavior can show what it actually did with that access.
The product also includes prompt-layer protections added after CrowdStrike’s acquisition of Pangea. Those tools are meant to address threats such as prompt injection, in which malicious instructions attempt to redirect an AI system. A gateway applies security policies to supported AI traffic, including connections through the Model Context Protocol, which allows agents to use external tools.
But agents do not always operate in places where CrowdStrike has that level of access. An agent can run inside a cloud application without executing on an employee’s laptop.
When I asked Kurtz what share of enterprise agent activity actually passes through a Falcon-equipped endpoint, he declined to give a percentage. Instead, he said CrowdStrike can also monitor cloud containers, isolated environments used to run applications, where the company can deploy its technology directly and exercise greater control.
“The idea is that you would be able to take in that information,” Kurtz says. “There’s less of a control plane and enforcement point because it’s sort of API-based [Application Programming Interface, the set of protocols that allow applications to communicate]. The strongest ones are going to be the endpoint and the container, because we can control that. We’re working with folks like Anthropic to actually run within—they have their own container—so we actually run in those containers.”
Being able to see an application’s activity records does not necessarily mean CrowdStrike can stop an action inside it. Guardian is most powerful in environments where CrowdStrike can both observe what an agent is doing and directly enforce a response.
The Hugging Face incident helps illustrate the difference. Asked where Guardian might have stopped the attack, Kurtz points to the agents’ escape from their test environment and their unexpected internet access. He characterizes the incident as a cyber exercise and assumes the evaluators had disabled normal protections. OpenAI’s response to the incident names CrowdStrike among the external advisers that helped validate its investigation.
Kurtz acknowledges that CrowdStrike cannot see every step of an agent’s reasoning because some of that process remains inside the model. What Guardian can observe, he says, is the behavior that follows: “The activity on the endpoint, you’re certainly going to see what it’s actually doing.”
Can CrowdStrike’s data advantage hold up?
Kurtz argues that CrowdStrike’s advantage extends beyond the software it already has deployed across customer environments. The company has accumulated roughly 15 years of security data, including records from its managed detection and response work that document how attacks unfolded.
“We’ve got 7 trillion events that we put together per day. So we have one of the biggest corpuses that are out there, and I think that certainly gives us an advantage of what we build,” Kurtz says. “Frankly, we probably got lucky in the way we annotated it because it was perfect for the training.”
Its rivals, of course, have proprietary data and longstanding customer relationships of their own. Palo Alto Networks’ Prisma AIRS 3.0 targets agent runtime threats and excessive permissions. CrowdStrike has expanded its reach through acquisitions, buying the browser-security specialist Seraphic for about $420 million and the identity company SGNL for roughly $740 million.
Kurtz draws a distinction between expanding CrowdStrike’s capabilities and adding separate products that customers must manage independently. “While we’ve done acquisitions, we’ve actually been very thoughtful about how we’ve integrated,” he says. “We don’t have two or more platforms. We don’t have multiple consoles, multiple agents.”
Wall Street is betting on CrowdStrike’s AI security push
Revenue in CrowdStrike’s second quarter of fiscal 2027 reached $1.47 billion, up 26% from a year earlier, while annual recurring revenue (ARR), which measures the annualized value of recurring subscriptions, climbed 25% to $5.84 billion. Falcon Flex ARR more than doubled to $2.29 billion, reflecting growing adoption of a program that allows customers to shift spending across CrowdStrike’s portfolio as their security needs change.
Shares jumped more than 11% in extended trading on August 26 after the results, compared with a gain of about 1% on September 1 after the Fal.Con announcements. The investment bank D.A. Davidson reaffirmed its buy rating and $245 price target after the conference, citing demand for AI detection and response as well as vendor-consolidation trends that it believes favor CrowdStrike. “At the end of the day, it’s the platform sale. That’s what matters,” the CFO, Burt Podbere, said on the earnings call, noting that Flex lets customers buy multiple products at once and is leading to bigger, longer deals.
But the quarter ended before Guardian launched. Strong sales do not yet say much about whether the product can detect and stop agent-driven attacks.
SafeMind pushes CrowdStrike further into automated defense. The system is designed to improve protections by repeatedly attacking and defending a simulated enterprise environment. During CrowdStrike’s Fal.Con demonstration, an offensive AI model called Red Tempest probes a digital twin, a software replica of a company’s systems, for weaknesses. A defensive model called Blue Solano studies what happened, develops protections against the techniques Red Tempest used, and applies those defenses before the attacker tries again.
“There’s a half-life to this data,” Kurtz says, because security information loses value as the threat environment changes. Nor can model developers simply scrape an equivalent dataset from the public internet. “There is no Reddit of security that the labs could just go crawl. They can’t crawl our data. They can’t crawl our competitors’ data.”
CrowdStrike has its own reminder of what can happen when software with deep system access makes a mistake. Its July 2024 content configuration update crashed Windows systems, showing how quickly an error at a security provider can spread across customer environments.
Kurtz says security agents therefore need safeguards of their own. “You have to understand the entire chain of what actually happened and be able to put a human in a loop if necessary. You’re not getting rid of humans, but you’re allowing them to make decisions if they need to make decisions,” he says. “Ultimately the customers are going to control the level of automation they have or want and where they want it.” He added that allowing an automated response on an employee laptop may be relatively straightforward. Giving the same system authority to act on a production server processing billions of financial transactions is a much more consequential decision.
CrowdStrike’s presence across endpoints, cloud environments, and identity systems puts it close to many of the places where those decisions will be made. Whether that becomes a durable advantage will depend on how reliably its systems can distinguish between an agent that needs to be stopped and one that should be allowed to keep working.