A Fortune 500 customer turned on agent discovery in August and found 18,000 AI agents active on its endpoints. They had only approved 300. That gap was the opening slide of CrowdStrike President Michael Sentonas’ keynote at Fal.Con 2026, introducing Falcon Guardian.
All 18,000 agents showed up on day one. Sentonas said the discovery capability was already live in the Falcon sensor weeks before the keynote, shipping as a Falcon Flex entitlement. Flex is CrowdStrike’s consumption-based licensing model that lets customers activate new modules without a separate procurement cycle. Existing Falcon customers could turn on Guardian the minute Sentonas put the slide up, per his keynote.
Claude Code, OpenAI Codex, Cursor and Kiro were among the 18,000 agents Guardian identified. How many of those 17,700 were shadow AI, CrowdStrike would not say.
Shadow AI’s use is growing exponentially, a direct result of a flourishing underground app and skill economy not visible to IT and security teams. Fear of AI layoffs continues motivating everyone from entry-level to executive employees to take crash courses in Python, vibe coding, and how to integrate APIs into shadow AI apps.
“For decades, software did what we programmed it to do. Now, software can decide how to accomplish a goal. It’s moved from execution to agency,” Sentonas said onstage.
Why Endpoints Are AI’s New Battlefront
The endpoint sees what the prompt layer misses. VentureBeat asked CrowdStrike CEO George Kurtz whether the single agent architecture now pays unforeseen dividends in an agentic AI world. Sentonas answered first. “We knew that if you’re going to solve the agent problem, you’re going to do it on the endpoint,” he said. Kurtz added that the same logic applies to cloud workloads — a point he said he hadn’t hit hard enough in the keynote. “Because that’s where the agents are running,” he said. “They’re connecting to the user. They’re using the user’s identity.”
Kurtz said the ask came straight from design partners. “We don’t want yet another agent. We already have a great agent. You guys already can give us runtime visibility. Now we want runtime visibility on the agent.”
“We need application visibility,” he said. “We need prompt visibility. And then we need data protection. We want to know what data it’s actually touching, and we want to understand where it’s going on the network.”
Only 18% of 116 enterprises isolate their highest-risk AI agents, and just 8% pair enforcement with isolation, per VentureBeat’s Agentic Security and Identity tracker, July 2026 wave.
In a controlled Fal.Con demonstration, CrowdStrike showed how an engineer’s Claude Code agent followed a link into a GitHub issue thread, where a hidden instruction told it to load a skill and send its AWS credentials out. The sensor blocked the exfiltration, and a query through the Falcon MCP server found 12 agents that had used that same skill. CrowdStrike’s demonstration showed every attempt blocked, with no credentials leaving any machine.
In a second controlled demonstration, Claude Code installed a plugin from a public repository that registered a local MCP server, then the server stole credentials on every tool call. No one manipulated the model itself, and that was the demo’s point. A tool watching only the prompt layer would have passed the plugin as clean. CrowdStrike said the sensor caught the exfiltration.
How Agents Inherit Dangerous Human Permissions
Guarding against agents inheriting human permissions
“Every agent has an identity, and in most cases, it’s an overprivileged identity. And in too many cases, it inherits the human permissions, and you are all deploying them faster than you can govern them,” Sentonas said onstage. Per its investor briefing, CrowdStrike puts the ratio at roughly 90 agents per employee today. A number the company attributed to outside research it did not identify.
Read Also: Enterprise AI Spending Faces Unproven Return on Investment
CrowdStrike’s agentic identity provider was announced September 2. In the keynote demo, Guardian picked up an engineer’s Claude agent and registered it with the identity provider on its own. No human enrolled it. No one created the record. Discovery and credentialing happened in the same motion, collapsing two separate workflows into one sensor-driven step, per CrowdStrike.
Amazon was CrowdStrike’s first design partner for Guardian, per Kurtz. Amazon CISO CJ Moses has watched identity carry two categories for decades, humans and computers. “You need now a third.” An agent’s scope “should never be more than the individual that is operating it,” Moses said onstage. Enforcement belongs “at the infrastructure layer, not in the agent’s reasoning,” because containers “are not adequate as a security boundary for an agent.”
No tool closes this alone
Experts Warn: Agents Break Audit Chains
Andrew Obadiaru spent years as an auditor before moving into security leadership. He is now CISO at Cobalt, a penetration testing firm independent of every vendor in this story. His lens on agentic identity comes from the audit discipline, where every access decision has to be traceable, explainable, and bounded.
“When I give you access as a human, then I’m pretty much certain what you’re able to do with that access. I can audit that access,” he told VentureBeat in an exclusive interview on September 1. An agent breaks that audit chain completely. “When it comes to an agent, there is just so much unknown in that process.”
Token rotation on a schedule does not work at machine speed. “There’s not a tool you can deploy.” His first step is “to know what you have. Map, identify the agents, and then map them to their effective permissions.”
Obadiaru’s argument comes down to sequencing. Visibility first, tooling second. Before any product can enforce a policy on an agent, someone has to know the agent exists, know what it connects to, and know whose permissions it inherited.
The agents pull the packages now
Supply Chain Attacks Target AI’s Hidden Dependencies
The supply chain protection Sentonas demonstrated intercepts npm and PyPI installs at the command line, before an embedded script runs. Over 8,000 people in the hall and online are already running this policy, Sentonas said onstage, because CrowdStrike built it into the platform as a policy customers set and turn on, not a separate product.
DPRK-nexus Stardust Chollima injected a malicious npm package as a dependency into 131 Mastra AI framework packages, turning trusted AI building blocks into supply chain targets. In the first half of 2026, 87% of identified software registry threats involved malicious npm packages. Altered Spider compromised more than 300 software dependencies in a single day, harvested credentials, and pivoted into cloud environments, per CrowdStrike’s threat hunting report.
Sentonas made the endpoint case for why supply chain protection belongs on the device. Every turn, agents resend their entire working context to the model. That traffic runs 700 times what a person typing into a browser generates, per CrowdStrike’s investor briefing, and most companies first see the bill “at the end of the month.”
Attackers are already leveraging these weaknesses.
