Newsletter
- CrowdStrike has introduced a AI Kill Switch that allows security administrators to block unauthorized AI proxies through the gateway. In the future, it is also planned to support directly terminating processes on terminals.
- The cybersecurity company has signed an agreement to acquire the AI observability startup Fiddler. It is reported that the transaction amount is approximately $400 million, with the aim of monitoring proxy behavior and explaining automated decisions.
- The merged technology is aimed at enabling enterprises to have better control over AI proxies. Such software can access company systems and perform operations without the need for continuous human supervision.
CrowdStrike has launched a AI proxy kill switch aimed at preventing unauthorized activities within corporate networks. At the same time, they also plan to acquire a AI observability startup Fiddler. This move comes as more and more companies are allowing more autonomous software access to their systems.
The cybersecurity company announced this release at the Fal.Con Europe 2026 conference held in Barcelona on Tuesday, expanding its Falcon Guardian security platform to include control features that allow administrators to intervene when AI proxies deviate from their designated tasks.
This measure is aimed at the issues companies face when deploying AI systems that are capable of executing code, accessing sensitive information, and interacting with business applications. Unlike traditional chatbots, these agents can perform a range of operations under limited human supervision, and may cause damage even if no one intentionally initiates an attack.
In practical use, an agent authorized to organize company documents may misinterpret instructions, execute malicious commands embedded in the documents, or carry out orders that were never intended by its operator. The greater the access permissions granted to autonomous agents, the higher the potential cost of their mistakes may be.
How does CrowdStrike's AI kill switch operate?
The new AI Kill Switch allows security administrators to interrupt the activities of a proxy before it completes its tasks. According to the technical documentation of CrowdStrike, the currently available mechanism operates through the AI gateway and can prevent the proxy from accessing the models that drive its decisions.
The first version does not yet provide all the containment capabilities described by CrowdStrike. The company plans to expand this feature to allow for the direct termination of proxy processes on terminals, as well as to coordinate restriction measures in cloud environments and other enterprise systems.
After the authorized administrator triggers kill and switch, this operation will be recorded in the audit logs. CrowdStrike also describes control measures to prevent terminated proxies from restarting and to restrict their network access, but more extensive implementation capabilities are still under development.
The company has also added protections in other aspects of the proxy operations. Falcon Guardian allows for checking of proxy prompts, and application strategies can be implemented for tools such as Claude Code, OpenAI Codex, GitHub Copilot, Microsoft, Copilot, Cursor, and OpenCode on a 365-day basis.
Relevant risks have been fully documented. As previously reported by Decrypt, Microsoft researchers discovered a vulnerability in the Claude Code GitHub Action of Anthropic. Attackers could exploit this vulnerability by using malicious repository content to manipulate this encoding proxy, thereby leaking sensitive credentials. Anthropic subsequently patched this flaw, but the solution proposed by CrowdStrike is more comprehensive.
The acquisition of Fiddler will enhance the visualization of proxy decision-making.
CrowdStrike has also signed an agreement to acquire Fiddler AI, a company that focuses on monitoring AI models and interpreting their behavior.
According to The Wall Street Journal, the valuation of this transaction for Fiddler is approximately $400 million. The acquisition price of CrowdStrike has not yet been publicly disclosed, but it has been stated that the transaction will be primarily paid in cash, with a portion of the shares being subject to attribution conditions.
The technology of Fiddler addresses an issue that is related to kill and switch, but cannot be solved independently: before a problem occurs, it is necessary to understand what the AI proxy is actually doing and whether its behavior was appropriate at that time.
Its software will evaluate proxies before deployment, track their decisions and tool calls, and monitor changes in their behavior after they start running. These records can help security teams investigate abnormal behavior or provide evidence for auditors.
CrowdStrike is expected to complete the acquisition of Fiddler in the fourth quarter of the 2027 fiscal year, which ends on January 31, 2027, provided that customary closing conditions are met. The specific release date for its expanded terminal kill-switch has not yet been announced.
