CrowdStrike Adds an AI Kill Switch and Buys Fiddler and Dreadnode to Police Rogue Agents
Photo: Hippopx (public domain). Illustrative image.
What happened. CrowdStrike used its Fal.Con Europe conference in Barcelona on Tuesday 3 November 2026 to make three moves on AI agent safety at once: it launched an AI Kill Switch in its Falcon Guardian product, and it signed definitive agreements to acquire two start-ups — Fiddler AI, which tracks what agents do, and Dreadnode, which attacks AI systems to find their flaws before they ship.
The kill switch. The AI Kill Switch is available now, according to CrowdStrike. It lets an authorised administrator terminate an agent that has broken out of its intended behaviour, block it from launching again across the organisation, and cut off its enterprise network access, with every action recorded in an audit trail. There is one important limit to note: termination currently happens first at the Gateway, and endpoint termination — stopping the agent on the device itself — is described as coming soon. Falcon Guardian, which discovers the agents running inside a company, enforces policy on what they can do and detects attacks against them, has been generally available since September 2026.
The two acquisitions. Fiddler AI sells tools that record and explain what AI models and agents do — CrowdStrike chief executive George Kurtz calls it the flight recorder for every agent. Its technology is due to be sold as Falcon Observe, with general availability planned for CrowdStrike’s fourth quarter of fiscal 2027. Dreadnode runs more than 100 known AI attack strategies, including jailbreaks, prompt injection and multi-turn and agent-specific attacks, against models, agent reasoning loops, applications and the MCP servers that connect agents to tools. Its team will join CrowdStrike’s Cyber Superintelligence Lab, and its findings will feed Falcon Guardian as policy recommendations.
The price — and what is still unconfirmed. CrowdStrike did not disclose what it is paying for either company. The Wall Street Journal reported about $400 million for Fiddler and about $95 million for Dreadnode, a combined $495 million — those figures are the Journal’s reporting, not CrowdStrike’s disclosure. Both deals are to be paid predominantly in cash, with a portion in stock subject to vesting, and are expected to close in CrowdStrike’s fiscal fourth quarter of 2027 — its fiscal year ends on 31 January, so that quarter runs from November 2026 to January 2027 — subject to customary closing conditions. Neither deal has closed yet.
Why it matters. The announcements target three different points in an agent’s life: stopping it while it runs, understanding what it did, and testing it before release. As agents chain steps together and take actions nobody explicitly authorised, companies are discovering that deploying agents is the easy part — staying in control of them is the product. CrowdStrike’s bet is that the company that can stop, explain and pre-test agents becomes the control layer for enterprise AI. Whether the kill switch works in every environment, including on the endpoint where it is not yet available, is the claim to watch as customers deploy it.
Sources
- CrowdStrike press release, 3 November 2026: https://www.crowdstrike.com/en-us/press-releases/crowdstrike-introduces-ai-kill-switch-for-ai-safety/
- CrowdStrike press release, 3 November 2026: https://www.crowdstrike.com/en-us/press-releases/crowdstrike-delivers-ai-security-safety-for-the-enterprise/
- The Wall Street Journal — “CrowdStrike to Buy Two AI Security Startups for $495 Million” (3 November 2026), via CellCog summary: https://cellcog.ai/blog/crowdstrike-ai-kill-switch/
