CrowdStrike has unveiled new security capabilities designed to detect and contain rogue AI agents.
Agent Insider Threat Detection is scheduled to arrive in Falcon Next-Gen SIEM in Q4 – the company said it can learn the normal behaviour of AI agents and the employees who operate them, identifying suspicious activity even when an agent has not technically breached a security policy.
Once unusual behaviour is detected, the system can launch coordinated investigations across endpoint, identity, software-as-a-service, cloud and network environments. Specialist AI agents will analyse evidence simultaneously, sharing context to distinguish genuine threats from benign activity.
CrowdStrike said the technology is designed to produce a verdict within seconds, with analysts able to use Falcon Guardian's AI Kill Switch to terminate an agent.
“AI agents can be both an insider threat and an adversary,” Michael Sentonas, President of CrowdStrike, said in a statement from Fal.Con Europe 2026, in Barcelona this week.
“One acts without authorisation from inside your walls. The other is weaponised against you from outside. Stopping the insider means knowing the moment an agent turns, investigating across every domain, and shutting it down at machine speed. That's the next evolution of the agentic SOC.”
Alongside the new detection capability, CrowdStrike confirmed that its coordinated multi-agent investigations, first unveiled at Fal.Con US in September, are now generally available.
Other capabilities available now include Charlotte Agentic SOAR's single governed automation workspace, with a further wave of features scheduled for Q4. These include AI Ecosystem Detections covering large language model API abuse, stolen API keys and compromises involving coding assistants, Model Context Protocol servers and agent frameworks.
CrowdStrike will also extend agentic triage to Falcon Guardian, cloud security, SaaS, data security, and custom detections, while expanding approval controls from individual tool calls to entire agents, applications and workflows.
Other Q4 additions will will include real-time visibility into AI credit consumption by SOC agents and workflows, while federated search will expand, with connectors for GovCloud, Dynatrace, Databricks, and Snowflake available now, and Splunk, Elastic and Cribl Lake connectors scheduled for Q4.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
