CrowdStrike launches a gateway kill switch for AI agents and plans endpoint support

CrowdStrike made its agent kill switch available at the gateway and said endpoint support is coming soon.

CrowdStrike announced an AI Kill Switch in Falcon Guardian on November 3 at Fal.Con Europe. The company describes a control that lets a defender terminate an agent at its point of execution, prevent it from relaunching and restrict network access. CrowdStrike says the kill switch is available at the gateway. It lists endpoint support as coming soon. [CrowdStrike announcement](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-delivers-ai-security-safety-for-the-enterprise/) · [Investor release](https://ir.crowdstrike.com/node/17956/pdf)

Stopping execution and limiting the effects are separate jobs

Terminating a process can end its current run. An enterprise still needs to know what tools it had reached and which changes it made before the stop. A payment instruction or an update to another system can persist after the originating process ends. A well-understood response separates immediate containment, revocation of external credentials and investigation of completed actions.

CrowdStrike describes planned endpoint enforcement alongside agent-level hooks and network inspection. Those controls address different points in execution. A team testing them would need to establish which environments are covered and which actions can still occur through remote services or previously issued credentials. [CrowdStrike announcement](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-delivers-ai-security-safety-for-the-enterprise/)

What defenders need to see during a drill

A drill could give an agent permission to act in a controlled environment and trigger a stop while it is working. The team would check which processes ended, whether a new run could start and whether outside credentials were still usable. It would also record what happened to work already in progress.

The feature’s value is clearest when defenders know what the control reaches and where another action is required. The announcement establishes CrowdStrike’s product direction. A customer still needs evidence from the runtimes, permissions and external tools it actually uses. [Investor release](https://ir.crowdstrike.com/node/17956/pdf)