An AI kill switch is only as good as the agent’s identity

What happened

At its Fal.Con Europe conference on 3 November, CrowdStrike announced deals to buy two companies. Fiddler AI monitors what AI agents do and why, and will be sold as Falcon Observe, which isn’t yet available. Dreadnode tests models, applications and agents for weaknesses before they go live, running more than 100 known attack strategies and mapping findings to OWASP, MITRE ATLAS and NIST frameworks. Terms weren’t disclosed, and both deals are expected to close in CrowdStrike’s fiscal fourth quarter of 2027.

CrowdStrike also launched an AI Kill Switch in Falcon Guardian, which it says is available today. An authorized administrator can stop a rogue agent where it runs, block it from relaunching “on the targeted host or host group” and cut its access to the company network, and every action is recorded in an audit trail. CrowdStrike’s release says termination works “first at the Gateway, and soon on the endpoint,” though the same release also describes the switch as starting on the endpoint, so buyers should confirm coverage.

My view

Every firm putting agents into production will need a stop button, and the OCC said as much this week. The harder question is what the button presses.

To stop one agent without stopping anything else, the security tool has to know which agent is which. That sounds obvious. In practice many agents today run under a person’s credentials, a developer’s token or a shared service account used by several integrations. If the agent is the person, from the network’s point of view, then stopping the agent means stopping the person. If it shares a credential with three other processes, revoking it breaks all four. A kill switch on a borrowed identity is either too blunt to use or too narrow to work.

The release itself hints at this. The relaunch block applies to a host or a group of hosts. That is how endpoint security has always worked, and it’s a sensible start. But agents don’t stay on one machine. The same agent can run on a laptop, a build server and a cloud function. The durable control is the agent’s own identity, so that stopping it means stopping it everywhere it runs.

Identity first, then the switch

The order of operations matters. An agent should be admitted the way a new employee is: with its own identity, a named human owner, a stated purpose, access limited to that purpose and an expiry. Once that exists, monitoring can say what this specific agent did, testing can say what it could be tricked into doing and a kill switch can stop it cleanly, with the owner told why.

Watch where the switch sits

CrowdStrike says the switch terminates agents at the gateway first, with the endpoint to follow. That’s a practical start, and buyers should map it against where their agents run. An agent operating on a laptop, in a developer’s terminal or inside a SaaS product may never cross the gateway. Coverage gaps are normal in a first release. They just need to be known, not discovered during an incident.

Monitoring and testing are evidence, too

The two acquisitions point at the other half of agent security. Testing before release and observing behavior afterward both produce records: what was tried, what failed, what the agent did on a given day. Those records are what an auditor, a regulator or a firm’s own incident team will ask for. They are most useful when they’re tied to the same agent identity as the kill switch, so the story of one agent is in one place.

Why it matters

For the industry. Security vendors are moving fast to own the agent control plane: discovery, testing, monitoring and response. Firms buying these tools should ask a prior question first: do we know which agents we have, who owns each and what each is allowed to reach? Without that inventory, every tool in the category works on guesses.

How it connects to our work. Agent Onboarding gives each agent its own bounded identity and a named owner, so it can be suspended or revoked on its own without touching anyone else’s access. AI Governance Evidence covers the records that make a stop defensible afterward. Before turning on a kill switch, I’d check four things:

• One agent, one identity. No agent runs on a person’s login or a shared credential.
• A named owner. Someone is told when their agent is stopped, and decides whether it returns.
• Known coverage. List where each agent runs and whether the switch can reach it there.
• A rehearsed stop. Pausing an agent is tested, with the manual fallback for its work known in advance.

Sources

• CrowdStrike introduces the AI Kill Switch for AI safety, CrowdStrike, 3 November 2026
• CrowdStrike to acquire Fiddler to deliver agent observability for AI trust, CrowdStrike, 3 November 2026
• CrowdStrike agrees to buy AI security startups Fiddler and Dreadnode, The Next Web, 3 November 2026

SecurityAI agentsIdentity

Linked sources are the record. Check them for the full reporting.