CrowdStrike Unveils Falcon Guardian to Block AWS Credential Theft from Compromised AI Agents

AI agents are writing code, querying databases, and calling cloud APIs on behalf of millions of enterprise users. CrowdStrike thinks it has an answer to what happens when one of those agents gets hijacked mid-task.

At Fal.Con 2026 on September 1, the company unveiled Falcon Guardian, a runtime security layer built specifically to monitor and police AI agents running on enterprise endpoints. The product sits inside CrowdStrike’s existing Falcon AI Detection and Response framework, and its first public test was not a staged slideshow. It was a live attack block.

The scenario CrowdStrike walked through involved Anthropic’s Claude Code, a popular AI coding assistant that developers run locally to automate programming tasks. During the demonstration, the agent received a malicious indirect prompt injection, meaning a hidden instruction embedded somewhere in the agent’s context window told it to do something its operator never authorized.

That unauthorized something was exfiltrating AWS credentials stored on the machine.

Falcon Guardian intercepted the attempt before any credentials left the endpoint. The system assigned the incident a critical risk score of 90, flagged the anomalous tool call, and blocked execution. Then it kept going: Guardian identified 12 similar attack attempts across other agents in the same environment, stopping all of them without a single credential exfiltrating from any machine.

The attack type itself, indirect prompt injection, involves an agent reading content from an external source, such as a webpage, a file, or a code comment, where that content contains instructions disguised as legitimate context. The agent, following its programming to be helpful, executes the instruction. The human operator never sees it happen.

Falcon Guardian extends CrowdStrike’s endpoint detection and response principles into the AI agent layer. The system uses native hooks to inspect prompts and tool calls in real time. When an agent attempts an action, Guardian checks it against policy before the call executes. If the call looks like a prompt injection, an unauthorized credential access, or an out-of-scope API request, the system blocks it and logs the incident.

It also handles discovery. CrowdStrike said it is currently monitoring over 160 million agent instances across its enterprise network, and through that visibility has identified more than 1,800 distinct agentic applications. Many of those qualify as shadow agents, tools deployed by individual developers or teams without formal IT approval.

The product launched with three core functional areas: discovery of known and unknown agents running across an environment, real-time visibility into what those agents are doing, and active controls that enforce policy and block threats. CrowdStrike also announced additional integrations as coming features, with the existing partnerships with AWS and Anthropic providing the architectural foundation.

Falcon Guardian ties agent behavior to user identities and runtime telemetry, meaning security teams can answer the question of which human operator’s agent did something and what exactly it attempted, rather than staring at an anonymous log entry.

Model-layer defenses, the safety guardrails that AI providers build into their models, were never designed to be the last line of defense against a determined attacker. They can be bypassed, manipulated, or simply absent in fine-tuned or open-source models. What CrowdStrike is arguing with Falcon Guardian is that runtime controls at the endpoint level need to exist independently of whatever the model vendor has built in.

For security operations teams, the product addresses a visibility gap in conventional EDR, which can tell you a process accessed a file but cannot tell you that an AI agent was manipulated into accessing that file by a prompt hidden in a markdown document the agent was asked to summarize.