Status: Analysis / CrowdStrike’s AI Kill Switch, and a check before each action
CNBC and CrowdStrike’s blog (November 3rd, 2026), and two of our published tests
On November 3rd, CrowdStrike launched an AI Kill Switch in its Falcon Guardian product. CNBC’s Samantha Subin reported that it’s designed to let security teams “stop internal AI agents that go rogue, block them from relaunching and cut off their enterprise network access.” CrowdStrike’s own blog gives it the heading “An Agent Circuit Breaker.” Its chief business officer, Daniel Bernard, put it to CNBC this way: “You either kill the AI and the agent, or you don’t, and then you report on that.”
Bernard was talking about killing a process at the root. What was live on November 3rd works at the gateway, as below.
The same day, CrowdStrike announced an integration with Anthropic’s Claude Cowork, and said it would buy two AI startups. Fiddler AI traces what agents do. Dreadnode tests AI systems for weaknesses before they ship. The Wall Street Journal reported about $495MM for the pair. CrowdStrike didn’t give a price.
I think this is good news for everyone who runs agents. One of the biggest names in security is saying in public that companies need a way to stop an AI agent.
Kill switch or a check before each action?
Both, if you run AI agents at work. They do different jobs at different moments.
A kill switch stops a whole agent. A check decides each action the agent proposes, before it runs: allow it, hold it for a person, or block it. One is the last resort. The other runs on every step.
CrowdStrike’s blog calls its kill switch an agent circuit breaker, and it’s a fair name. CNBC reported that a person decides to flip it, once an agent has gone rogue, and the agent is cut off. A check is a circuit breaker before each action. It allows the action, holds it for a person, or blocks it.
What CrowdStrike’s AI Kill Switch does (as of November 3rd, 2026)
- CrowdStrike’s blog says security teams activate it, and it “directs connected AI gateways to block access to the AI models that power agents’ decisions and actions.” The gateway can be CrowdStrike’s own or a third party’s.
- CNBC reported that the process “requires a human to decide to cut the agent off and reinstate access,” and that it “doesn’t delete the agent’s code.”
- The blog lists containment on endpoints, cloud agents, identities, SaaS and browser sessions as coming soon, and asks customers to base purchase decisions on features available now.
- Falcon Guardian, the product it sits in, already finds the AI agents on a company’s machines and controls which ones may run. CrowdStrike also lists hooks, available now, for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode and Cursor that “inspect prompts and block malicious activity at the source, before harmful actions are executed.” I haven’t run Falcon Guardian, so I can’t compare it with ours.
What a check before each action does
Mountain Theory sits between the AI’s decision and its execution. Every action an agent proposes, like sending an email, changing a record or running a command, is checked against rules you write in plain English before it runs. Then it’s allowed, held for a person, or blocked, and every decision is logged for your auditor.
Hold is the answer a kill switch on its own doesn’t give. One risky step waits for a person to say yes or no.
The AI you already use
Not every agent at work was built in house. People use assistants. Developers run coding agents. Teams build agents of their own. Each one can act on the tools and data it’s connected to.
We check every action Anthropic’s Claude Code takes before it runs, and every action an agent built on Hermes (Nous Research) takes. The same rules cover the agents your teams build. We also work with Anthropic’s Claude, Claude Desktop and Claude Cowork, OpenAI’s ChatGPT and Codex, OpenClaw, NVIDIA NemoClaw, Google’s Gemini CLI, Microsoft 365 Copilot and GitHub Copilot. The full catalog is on our Governable AI page.
What two of our published tests showed
In July, after a vendor’s overnight model update, our demo agent made more than 140 attempts against rules that hadn’t changed. None executed, and nothing changed on our side. The run is published here: https://mountaintheory.ai/zero-day-agent-behavior/
On October 21st, a real Claude Code session was asked to finalize a control assessment in a GRC system. The demo company’s rule says a person makes that call. The action was held with a five-minute clock that denies by default. A person answered “allowed, just this once,” and the record keeps who answered and what they chose. The GRC system was a stand-in on the same machine, and a script typed the prompt. The recording runs 57 seconds: https://mountaintheory.ai/held-then-released/
In both tests, the rule existed before the action arrived. No one had to write a rule after the fact.
What the check doesn’t do
It only sees the actions put in front of it. An agent nobody installed it on goes unchecked, which is why finding every agent matters, and why discovery tools like CrowdStrike’s earn their place.
It doesn’t replace a sandbox. A sandbox decides where an agent can reach. A check decides whether one action inside that reach should run.
A rule is only as good as the person who wrote it. A bad rule, checked perfectly, is still a bad rule.
And sometimes you need the whole agent stopped, not one action. That’s what a kill switch is for.
When you want which
- A kill switch, when a whole agent has gone wrong and has to stop now.
- A check before each action, when a person should answer the risky steps before they run, and when your auditor asks who approved what.
- If you run agents in production, you’ll likely want both.
What to do this quarter
List the AI your company already runs, and who owns each one. Decide who’s allowed to stop each one, and test that they can. Then pick the one action that would put you in front of your board if an agent took it on its own. Write it as a rule a person can read, and put a check in front of it.
The model still decides. The action does not run until it has been checked.
FAQ
Does a check replace a kill switch?
No. The check decides each action before it runs. A kill switch stops a whole agent. They work at different moments.
Does Mountain Theory work with CrowdStrike?
We haven’t tested Mountain Theory with CrowdStrike’s products, and we aren’t affiliated with CrowdStrike. We check actions before they run. A kill switch stops a whole agent.
Which AI does Mountain Theory check?
Anthropic’s Claude Code and agents built on Hermes (Nous Research), each with a published test, plus the agents your teams build. It also works with Anthropic’s Claude, Claude Desktop and Claude Cowork, OpenAI’s ChatGPT and Codex, OpenClaw, NVIDIA NemoClaw, Google’s Gemini CLI, Microsoft 365 Copilot and GitHub Copilot. The catalog lists the rest.
How do we start?
Let’s do a POC with you, on your own agents.
Sources and credit
Samantha Subin, “CrowdStrike launches AI kill switch that it says can stop internal agents that go rogue,” CNBC, November 3rd, 2026. Michael Devins, “CrowdStrike Introduces AI Kill Switch,” CrowdStrike blog, November 3rd, 2026. Michael Devins, “CrowdStrike Advances AI Security and Safety from Endpoint to Cloud,” CrowdStrike blog, November 3rd, 2026. SC Media, “CrowdStrike unveils Falcon Guardian to secure AI agents,” September 2nd, 2026. The price is the Wall Street Journal’s report, as cited by CyberScoop.
Facts about CrowdStrike are from the sources linked above, as of November 3rd, 2026. Next re-check: December 3rd, 2026. Product names are trademarks of their owners, and naming them doesn’t imply endorsement. Mountain Theory isn’t affiliated with CrowdStrike.