CrowdStrike Falcon Guardian Traces AI Agent Actions on Endpoints
Global – October 31, 2026 -- CrowdStrike's Falcon Guardian now traces supported AI agent sessions from prompt to impact on the endpoint, scoring every agent from 0 to 100 and blocking dangerous actions at runtime.
The product targets a blind spot in network-based monitoring. A gateway sees the conversation, and a web gateway sees an agent connect to a trusted site. Neither sees what happens inside the machine, where a hidden instruction can become a shell command or a downloaded file can run with the user's access.
Agent Graph links the AI layer to the execution layer
Falcon Guardian runs on the existing CrowdStrike Falcon sensor, which already sees processes, files and network connections. It now also sees prompts, models, tools and skills. CrowdStrike Agent Graph connects each agent to the users, hosts, models, prompts, tools, skills, MCP servers, processes, files and detections it touches, and keeps those links current as agents act.