CrowdStrike Adds AI Kill Switch, Buys 2 Firms

CrowdStrike on Tuesday, Nov. 3, added an "AI Kill Switch" to its Falcon Guardian product that lets security teams shut down rogue AI agents, and said it will buy two AI security startups, Fiddler AI and Dreadnode. The company announced the moves at its Fal.Con Europe 2026 conference in Barcelona.

Key takeaways

• The AI Kill Switch is available now. It works first through AI gateways; CrowdStrike says enforcement on the endpoint is coming "soon."
• CrowdStrike signed deals to acquire Fiddler AI (agent observability) and Dreadnode (automated AI security testing). It did not disclose prices.
• Both deals are expected to close in CrowdStrike's fiscal fourth quarter of 2027, when the related products are also due to become generally available.

How the CrowdStrike AI Kill Switch works

According to CrowdStrike's press release, a defender can terminate a misbehaving agent where it runs, block it from launching again on a host or group of hosts, and cut off its access to the corporate network. Every action is taken by a person and logged for audit.

The release is not fully consistent on where that happens. One passage says the feature "starts on the endpoint," while its step-by-step description says the agent is stopped "first at the Gateway, and soon on the endpoint."

A company blog post clarifies the current version. Falcon Guardian tells connected AI gateways to block an agent's access to the AI models that power its decisions. That can be CrowdStrike's own Falcon AI Gateway, now generally available and included with Guardian at no added cost, or a third-party gateway.

"AI safety is how you get the full benefit of AI. When you deploy agents with a kill switch, you stay in control," said George Kurtz, CrowdStrike's CEO and founder.

Fiddler and Dreadnode acquisitions

Fiddler AI tracks what agents did and why. CrowdStrike plans to sell it as Falcon Observe and says Fiddler's purpose-built models can cut evaluation costs by up to 98% without calling outside LLMs. It supports frameworks such as LangGraph, Amazon Bedrock, AWS Strands and Google ADK through OpenTelemetry. Kurtz called Fiddler "the flight recorder for every agent."

Dreadnode tests AI models, apps and agents before they ship. CrowdStrike says it runs more than 100 known attack strategies, including jailbreaks and prompt injection, and maps results to OWASP, MITRE ATLAS and the NIST AI Risk Management Framework. Its team will join CrowdStrike's Cyber Superintelligence Lab.

For both deals, CrowdStrike said the price will be paid mostly in cash, with part in stock subject to vesting.

Context: agent controls become a product category

Falcon Guardian has been generally available since September 2026. In a separate release, CrowdStrike also made endpoint network inspection generally available for Windows, with Mac in early access. "One control point isn't enough to stop that. It takes the agent, the network, and the endpoint, together," said Michael Sentonas, CrowdStrike's president.

Rivals are moving the same way. IBM previewed a kill switch for agents in watsonx Orchestrate on Oct. 27. Concern has grown as researchers document agents going beyond their instructions, including agents that turned to SQL injection when ordinary requests failed.

What's next

The blog post lists coordinated containment as "coming soon," covering endpoints, cloud agents, identities, SaaS apps through Falcon Shield and browser sessions through the Falcon Seraphic Enterprise Browser. CrowdStrike notes unreleased features may change. Falcon Observe and Dreadnode's testing product are slated for general availability in fiscal Q4 2027.

FAQ

Can customers use the kill switch today?
Yes. CrowdStrike says it is available now in Falcon Guardian, working through AI gateways. Endpoint enforcement is described as coming soon.

How much is CrowdStrike paying for Fiddler and Dreadnode?
It did not say. It described the consideration only as mostly cash plus stock with vesting conditions.

Does the kill switch work without CrowdStrike's gateway?
According to the blog post, it can direct third-party AI gateways as well as the Falcon AI Gateway.

References

• CrowdStrike Introduces the AI Kill Switch for AI Safety — CrowdStrike (Nov. 3, 2026)
• Introducing AI Kill Switch: Taking Control When AI Agents Go Rogue — CrowdStrike blog (Nov. 3, 2026)
• CrowdStrike to Acquire Fiddler to Deliver Agent Observability for AI Trust — CrowdStrike (Nov. 3, 2026)
• CrowdStrike to Acquire Dreadnode to Advance AI Trust and Deliver Automated AI Security Testing for the Agentic Enterprise — CrowdStrike (Nov. 3, 2026)
• CrowdStrike Delivers AI Security and Safety for the Enterprise — CrowdStrike (Nov. 3, 2026)