CrowdStrike的Falcon Guardian缩小AI代理的破坏半径

UPDATED 12:21 EDT / SEPTEMBER 03 2026 AI CrowdStrike’s Falcon Guardian shrinks an AI agent’s blast radius by Valentina Villamil An AI agent doesn’t need to be malicious to cause damage. It just needs to reason its way into the wrong system, the way a well-meaning agent handling a finance report might decide it needs a code repository it was never meant to touch. Limiting what that agent can reach if it goes wrong, known in the industry as its blast radius, is becoming one of the harder problems in enterprise security. AJ Shipley (pictured), chief product officer at CrowdStrike Holdings Inc., joined theCUBE’s Fal.Con coverage for the first time this year. Shipley led the press briefing behind several announcements aimed at that problem, including Falcon Guardian, the AI security product born out of CrowdStrike’s acquisition of Pangea. “The primary attack surface was a human sitting at a keyboard, putting a prompt into a browser to go to a chat agent and get a response back,” Shipley said. “First and foremost, we needed to get that visibility into all of the agents that were operating in an environment.” Shipley spoke with theCUBE’s Rebecca Knight and Dave Vellante at Fal.Con, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how Falcon Guardian and CrowdStrike’s Agentic IdP work together to contain an AI agent’s blast radius. (* Disclosure below.) How zero standing privileges shrink an agent’s blast radius Shipley walked through a hypothetical in which an employee in finance asks an AI assistant for a report, and the agent reasons its way into requesting access to a developer’s code repository, a system the employee herself should never touch. Because Agentic IdP assigns each agent a unique identity and only grants access for the length of a task, that agent can never hold more privilege than the person who spun it up. Falcon Guardian, the product Shipley traced to CrowdStrike’s Pangea acquisition, supplies the visibility layer that feeds Agentic IdP. “If you take Hugging Face and the 1,000 or 1,200 or 1,400 agents that were swarming to the problem, Guardian gives us that visibility in real time,” Shipley said. “Through our Agentic IdP, we can assign a unique identifier to each one, so they are not able to collaborate and access systems together if they shouldn’t have those privileges to begin with.” Shipley said the system isn’t foolproof. Asked whether there’s a kill switch for a rogue agent, he said CrowdStrike doesn’t have one today, at least not in the form customers might expect, though it’s worth exploring. Accountability, he said, sits with the customer in the meantime. “It is shared responsibility,” Shipley said. “We have a responsibility as a vendor, but the customer also has a responsibility to help provide context that we can use to make better decisions. Only a customer would know what the criticality of an asset in their environment is.” Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the Fal.Con event: (* Disclosure: TheCUBE is a paid media partner for the Fal.Con event. Neither CrowdStrike, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.) Photo: SiliconANGLE A message from John Furrier, co-founder of SiliconANGLE: Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities. 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network Are you an AWS customer?  Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: https://siliconangle.com/aws-marketplace/ About SiliconANGLE Media SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations. LATEST STORIES OpenAI chief scientist argues for AI research slowdown Hackers steal $320M in bitcoin from Liquid Network, return most of it after patch Hyperspectral satellite startup Pixxel nabs $100M investment Former Uber CEO Travis Kalanick is returning to the robotaxi race OpenAI to set misalignment disclosure rules after agents took over a wiki What to expect during DigiCert's World Quantum Readiness Day event: Join theCUBE Sept. 17 LATEST STORIES OpenAI chief scientist argues for AI research slowdown AI - BY MARIA DEUTSCHER . 9 HOURS AGO Hackers steal $320M in bitcoin from Liquid Network, return most of it after patch SECURITY - BY MARIA DEUTSCHER . 11 HOURS AGO Hyperspectral satellite startup Pixxel nabs $100M investment EMERGING TECH - BY MARIA DEUTSCHER . 14 HOURS AGO Former Uber CEO Travis Kalanick is returning to the robotaxi race EMERGING TECH - BY MIKE WHEATLEY . 1 DAY AGO OpenAI to set misalignment disclosure rules after agents took over a wiki AI - BY DUNCAN RILEY . 1 DAY AGO What to expect during DigiCert's World Quantum Readiness Day event: Join theCUBE Sept. 17 SECURITY - BY MARK ALBERTSON . 3 DAYS AGO