CrowdStrike used its Fal.Con Europe conference in Barcelona on 3 November to make three moves on AI agent safety at once. It launched the CrowdStrike AI Kill Switch, which lets security teams stop an AI agent that goes off course, and signed agreements to buy two start-ups: Fiddler AI, which tracks what agents do, and Dreadnode, which attacks AI systems to find their flaws.
Taken together, the announcements cover an agent’s life from testing to shutdown. CrowdStrike did not disclose what it is paying. It said both deals will be paid “predominantly in cash”, with a portion in stock subject to vesting, and are expected to close in its fiscal fourth quarter of 2027, subject to customary conditions.
In brief
- The AI Kill Switch in Falcon Guardian, available now, lets an authorised administrator stop a rogue agent, block it from relaunching and cut its network access.
- CrowdStrike has agreed to buy Fiddler AI for agent observability and Dreadnode for AI red teaming. Prices were not disclosed and neither deal has closed.
- Products built on both start-ups are due to become generally available in CrowdStrike’s fiscal fourth quarter of 2027.
How the CrowdStrike AI Kill Switch works
The kill switch sits in Falcon Guardian, CrowdStrike’s product for finding the AI agents running inside a company and policing what they do. According to the release, it gives defenders four controls. The Falcon sensor stops the agent “first at the Gateway, and soon on the endpoint”. Policy then keeps the agent “from relaunching on the targeted host or host group”, and the agent “loses its enterprise network access”. Finally, “an authorized administrator triggers the action, and every action is recorded in the audit trail.”
“AI safety is how you get the full benefit of AI. When you deploy agents with a kill switch, you stay in control,” said George Kurtz, CrowdStrike’s chief executive. Rick Orloff, chief information security officer at Everpure, said in the release that it “runs on the Falcon sensor we already have, and that’s what lets us say yes to more agents and more AI, faster.”
Fiddler AI: a flight recorder for agents
Fiddler AI, co-founded eight years ago by chief executive Krishna Gade, sells tools that record and explain what AI models and agents do. In its own announcement, Fiddler said it has “signed a definitive agreement to be acquired by CrowdStrike”. Gade gave the example of a coding agent that, faced with a permissions error, changes an access policy to make the error go away.
CrowdStrike will sell the technology as Falcon Observe, generally available in its fiscal fourth quarter of 2027. The release lists pre-deployment evaluation, agent tracing, auditable governance and support for agent frameworks including LangGraph, Amazon Bedrock, AWS Strands and Google ADK. It also claims Fiddler’s purpose-built models can “reduce evaluation costs by up to 98%” by avoiding calls to external large language models. “When a regulator or your board asks what an agent did, saying ‘the model did it’ is not an answer,” Kurtz said.
Dreadnode: attacking AI before attackers do
Dreadnode’s founders say they have spent three years building attack agents. CrowdStrike says the technology tests AI models, agent reasoning loops, applications and MCP servers for weaknesses before they reach production. CrowdStrike says its testing runs “more than 100 known AI attack strategies”, including jailbreaks and prompt injection, and maps findings to frameworks such as the OWASP Top 10 for LLMs, MITRE ATLAS and the NIST AI Risk Management Framework. A CrowdStrike blog post on the same deal gives a lower figure of “more than 50 attack techniques”.
Dreadnode’s founders, Brad Palm and Nick Landers, wrote in a post dated 2 November that “once the deal closes, our team will join CrowdStrike’s Cyber Superintelligence Lab”, and that “this isn’t an exit for us.” CrowdStrike plans to sell the product as Automated AI Security Testing, also due in fiscal Q4 2027.
Kill switches are becoming a standard feature
The kill switch is the headline, but it is the least novel of the three moves. Salesforce made an Agent Kill Switch generally available in Agent Fabric on 27 October, and IBM showed its own kill switch in preview the same week. ServiceNow’s AI Passport aims to limit what agents may do at runtime. CrowdStrike’s pitch is that its version runs on the Falcon sensor its customers already use. Its own release, though, says endpoint termination is still coming “soon”, so for now the stop happens at the Gateway.
The acquisitions say more about where security vendors expect the money to be. A kill switch only helps once someone notices an agent misbehaving. Fiddler is meant to supply that record of what an agent did and why, and Dreadnode to find the flaws before an agent ships. That matches the pressures in what trading rules and the EU AI Act already require of agent kill switches: companies need to show they can stop an agent and explain afterwards what it did. The open questions are price and timing. CrowdStrike has not said what it is paying, the deals have not closed, and both products are scheduled rather than shipping. Its claims, from a 98% cut in evaluation costs to the count of attack techniques, which its own blog and release put at 50 and 100 respectively, remain unchecked.
Closing the deals is the next step
Both acquisitions still need to complete, which CrowdStrike expects in its fiscal fourth quarter of 2027. Until then, the AI Kill Switch is the only one of the three that customers can use today. Once that deal closes, Dreadnode’s team joins CrowdStrike, whose researchers have previously reported an open-source AI tool being used against Korean banks.
Sources
- CrowdStrike: “CrowdStrike Introduces the AI Kill Switch for AI Safety”, 3 November 2026 (company release)
- CrowdStrike: “CrowdStrike to Acquire Fiddler for AI Agent Observability”, 3 November 2026 (company release)
- CrowdStrike: “CrowdStrike to Acquire Dreadnode for Automated AI Security Testing”, 3 November 2026 (company release)
- CrowdStrike blog: “CrowdStrike to Acquire Dreadnode”, Michael Sentonas, 3 November 2026 (company blog)
- Fiddler AI: “Fiddler to Join CrowdStrike: Building the Future of Agentic Security and Safety”, Krishna Gade, 3 November 2026 (company blog)
- Dreadnode: “Dreadnode Is Joining CrowdStrike”, 2 November 2026 (company post)
- @CrowdStrike on X: AI Kill Switch announcement, 3 November 2026 (official account)
- @CrowdStrike on X: Fiddler acquisition, 3 November 2026 (official account)
- @CrowdStrike on X: Dreadnode acquisition, 3 November 2026 (official account)
Related stories
- Salesforce Announces Agent Evals and Spending Caps for Agent Fabric
- IBM Makes Agent Identity GA; Its AI Agent Kill Switch Is in Preview
- AI Agent Kill Switches: What Trading Rules and the EU AI Act Require
- CrowdStrike Says Open-Source AI Tool ARTEX Was Used on Korean Banks
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
