CrowdStrike launches Falcon Guardian to police AI agents at the endpoint

CrowdStrike has unveiled Falcon Guardian, software that discovers AI agents running inside a company and blocks any that security teams have not approved. The launch came at the Fal.Con 2026 conference in Las Vegas.

Guardian is the expanded successor to Falcon AI Detection and Response, which added endpoint runtime protection and shadow AI discovery earlier this year. The new enforcement capability lets administrators maintain an allowlist of permitted agents, with anything else blocked at the endpoint.

The product builds a chain from a user’s prompt through the identity used, tools called and skills invoked, down to the agent’s actions on the system. It flags attacks aimed at agents as well as agents misbehaving on their own, and reconstructs the execution chain to calculate blast radius during an incident.

Two parts are not shipping yet: AI Gateway, which will apply Falcon policy to enterprise AI traffic including Model Context Protocol connections, is in pre-beta and due next quarter, and the managed detection and response tier Falcon Complete for Guardian is due later this quarter. Agent telemetry lands in Falcon Next-Gen SIEM as first-party data with retention included.