CrowdStrike's AI kill switch: can you stop your own agents?

CrowdStrike announced an AI Kill Switch for Falcon Guardian on 3 November at Fal.Con Europe in Barcelona. The feature lets an authorised administrator halt a misbehaving AI agent. The launch came with plans to buy Fiddler AI and Dreadnode for a reported $495 million. The useful question for NZ organisations sits beyond any one product: who'd stop an agent at 9pm on a Sunday, and how long would the stop take?

What CrowdStrike has shipped

The coverage and CrowdStrike's own material describe different scopes. Yahoo Finance reported that a defender can terminate an agent wherever it runs and block a relaunch. CrowdStrike's press release is narrower, placing enforcement at the AI Gateway today and on the endpoint "soon". Its product page describes the control as cutting access to designated AI models and providers through the gateway, with enforcement by agent type still to come.

Unite.AI's analysis matches the product page. The shipping control severs an agent's connection to its model services, using CrowdStrike's gateway or a third-party gateway the customer already runs. Each action goes into an audit trail. The same report puts several capabilities on the coming-soon list or roadmap, including ending agent processes on devices, containing cloud agents and revoking permissions at runtime. The press release gives no date for endpoint enforcement, and the product page doesn't state licensing terms.

Other vendors are working on the same problem. SC Media reports that Microsoft, Palo Alto Networks and Cisco are developing similar controls. BeyondTrust released AI Agent Security, reported on 5 November, which checks each agent action against policy before the action runs and can call for human approval.

Why a gateway cut-off is a partial stop

Our reading is that cutting model access stops an agent from planning its next step, and little beyond that. A gateway can act only on traffic that passes through it. An agent hosted inside a SaaS vendor's platform, or one calling a model on a local server, may sit outside the control unless someone has routed its traffic through the gateway.

Credentials are a separate problem. An agent's API keys and OAuth tokens don't expire because its model connection dropped, so a queued job or a second agent sharing those credentials could keep working. Payments already released and emails already sent stay released and sent.

Speed makes the gap worse. BeyondTrust's Phantom Labs counted about 1.28 million shell command requests from roughly 132,000 prompts over four weeks, close to 10 per prompt. It also found that 85% of observed coding-agent users had at least one MCP server configured, which links an agent to outside tools. The figures are vendor data from early customers and cover coding agents alone, so they won't describe a finance or customer service agent. They do show how one instruction can fan out into many actions before a person has read an alert, and CrowdStrike's switch needs a person to act.

The security agencies reached a similar position months ago. NCSC-NZ co-authored joint guidance on agentic AI, published on 1 May 2026. One published summary records its call to put reversibility and blast-radius containment ahead of efficiency, along with mandatory human approval for high-impact actions and just-in-time credentials. The UK NCSC's companion post says incident plans should cover loss of control and that organisations should decide in advance who can stop an agent. A kill switch helps with the last step of that advice. Limits on what an agent can reach do more of the protective work, because those limits apply before anyone notices a problem.

What it means for NZ businesses

We wouldn't start with a security purchase. A firm already paying for CrowdStrike should ask about Guardian, but CrowdStrike's public pages don't show what it would cost an NZ customer. Most organisations can get further by testing what they already own.

Microsoft 365 customers are a good example. Microsoft's Entra documentation explains how an administrator can disable a single agent identity, or use Conditional Access policies to block token issuance across the tenant. Conditional Access needs an Entra ID P1 licence. The same page carries two warnings worth reading before an incident. Agents built on earlier versions of Copilot Studio and Azure AI Foundry may exist as classic service principals without an agent identity, so they're governed as ordinary applications. Disabling agent identities can also cause other agents and some Microsoft features to fail. Microsoft recommends running the policies in report-only mode to see the impact, which is hard to do well in the middle of an outage.

Stopping the agent also doesn't close the incident. If an agent has exposed personal information, the Office of the Privacy Commissioner's 72-hour guide runs from the point an organisation becomes aware a breach is notifiable, and an employee's knowledge counts as the organisation's knowledge. Assessing harm depends on knowing what the agent read and sent, so logging has to be working before the agent goes live.

Staffing shapes the design too. A firm without a round-the-clock security desk should assume a delay between a fault starting and a person responding, and should cap what an agent can do unattended during that delay. Agents working overnight need tighter limits than agents working while staff are watching.

Practical next steps

If you're building or buying AI agents, we'd do the following before adding more autonomy:

• Build an agent register. Include vendor-hosted agents and anything staff connected themselves, with an owner, the credentials used and the systems each agent can reach.
• Write a stop procedure for each agent. Cover model access, credentials, scheduled jobs and the vendor's support contact.
• Name the people who can trigger a stop after hours. Give them the access now and add the procedure to your major incident process.
• Run a timed drill on a test agent. Record how long activity continues after the stop, and check whether tokens issued earlier keep working.
• Require human approval for hard-to-reverse actions. Payments, deletions and external messages are the obvious candidates, and short-lived credentials should replace long-lived keys wherever the platform allows.
• Get vendor answers in writing. Ask what ships today and what's on the roadmap, which traffic the control can see, and whether the control covers agents hosted by third parties.