CrowdStrike launches Falcon Guardian to police AI agents at the endpoint

CrowdStrike Holdings Inc. today unveiled Falcon Guardian, software that finds the artificial intelligence agents running inside a company and shuts down the ones security teams have not approved.

The launch came at the company’s Fal.Con 2026 conference in Las Vegas. Guardian is the expanded successor to Falcon AI Detection and Response, which went generally available in December and picked up endpoint runtime protection and shadow AI discovery at the RSAC Conference in March.

Enforcement is what has been added this time. CrowdStrike’s argument is that the device is where an agent reasons, plans and runs code, which makes it the one place with a complete view of what that agent actually did.

Discovery comes first. The Falcon sensor inventories known and shadow agents across Windows and macOS machines, both running and dormant, and logs who deployed each one along with its security status. Guardian then ties agent behavior back to endpoint telemetry, building a chain that starts at a user’s prompt and runs through the identity used, the tools called and the skills invoked, down to whatever the agent did to the system afterward. Administrators can name which agents are permitted to run on a managed endpoint. Anything not on the list gets blocked.