Falcon Guardian Turns 17,700 Shadow Agents Into Identities

CrowdStrike’s Falcon Guardian found 18,000 AI agents on a Fortune 500 customer’s endpoints in August, against an approved list of 300. Michael Sentonas, CrowdStrike’s president, put that gap on the opening slide of his Fal.Con 2026 keynote in Las Vegas on September 1.

A day later the company began turning those findings into identities. Falcon Guardian now feeds the CrowdStrike Agentic Identity Provider, which registers an agent as soon as the sensor sees it.

An 18,000-Agent Inventory on Day One

All 18,000 showed up the first day the customer switched discovery on. The sensor had already been sitting in the Falcon agent, shipping as a Falcon Flex entitlement, so existing customers could switch Guardian on without a new purchase cycle. Sentonas said some of them activated it the same day.

CrowdStrike introduced Guardian on September 1 as an AI Detection and Response module that puts runtime enforcement from the endpoint at the center of agent security. George Kurtz, CrowdStrike’s CEO and founder, said the company pioneered EDR by making the endpoint the control point, and that AI needs the same move because governance alone cannot stop an agent already in motion.

WHAT THE SENSOR COUNTED FIRST

• Approved list: The customer had signed off on 300 agents before discovery ran.
• Where it looks: Live inventory covers known and shadow agents on Windows and macOS, running and dormant.
• How it ships: Flex lets a current Falcon customer turn the module on without a separate buy.
• Working ratio: CrowdStrike executives briefed investors on a working figure of 90 agents per employee, and Kurtz said the real number could run far higher.

Claude Code, OpenAI Codex, Cursor, and Kiro were among the 18,000. CrowdStrike would not say how many of the leftover 17,700 were shadow AI. On September 2 it said Guardian would also cover Codex coding agents at runtime, pairing that work with OpenAI’s GPT-5.6 Cyber model on the Falcon platform.

AI security starts at the endpoint. 🛡️

Introducing Falcon Guardian, our new AI Detection and Response (AIDR) solution delivering complete visibility and runtime enforcement from the endpoint, where AI agents execute and across the enterprise.

Discover agents. Surface risk. Stop… pic.twitter.com/j76QF2cYRB

— CrowdStrike (@CrowdStrike) September 1, 2026

Design partners had already told CrowdStrike they did not want another agent on the box. They wanted a live view of the ones they already had, tied to the user’s identity, because that is where the agents run.

Discovery Feeds a New Identity Directory

Sentonas said every agent has an identity, and in most cases it is overprivileged. In too many cases it inherits the human’s permissions, and companies are deploying agents faster than they can govern them. The September 2 identity product is how CrowdStrike turns that complaint into a directory record.

THE IDENTITY CALENDAR

1. June 15, 2026: CrowdStrike releases Continuous Identity for AI Agents, issuing each agent a cryptographically verifiable identity on the SPIFFE standard and authorizing each action against owner, caller, and device risk.
2. September 1, 2026: Falcon Guardian goes generally available and starts listing every known and shadow agent the Falcon sensor can see.
3. September 2, 2026: The Agentic Identity Provider adds automatic registration for every agent Guardian finds, under one directory, the moment it comes online.

Scott Kriz, general manager of Continuous Identity at CrowdStrike, put the sequencing in one line. You cannot continuously authorize an identity you were never able to establish, and classic identity providers break the moment an agent acts on its own.

Continuous Identity modernized identity security for the agentic era, but you cannot continuously authorize an identity you were never able to establish, and traditional identity providers break the moment an agent acts on its own. Agentic IdP is the identity provider for AI agents.

Scott Kriz, GM of Continuous Identity, CrowdStrike press release, September 2, 2026

Registered agents get short-lived tokens scoped to one task. They do not get standing credentials of their own. Every action is bound to the human or workload behind it. In the keynote demo, Guardian picked up an engineer’s Claude agent and enrolled it with no human in the loop.

Amazon was the first design partner, Kurtz said. Amazon CISO CJ Moses told the hall that identity has carried two categories for decades, humans and computers, and that a third is now required. An agent’s scope, he said, should never be more than the individual operating it, and enforcement belongs at the infrastructure layer, not in the agent’s reasoning, because containers are not an adequate security boundary for an agent.

Andrew Obadiaru, CISO at Cobalt and a former auditor, argued the same sequence from the other side of the vendor table. When he grants a human access, he can audit what that person can do. With an agent, too much of the path is unknown. Token rotation on a calendar does not work at machine speed, and there is not a tool you can drop in to fix that. His first step is still to know what you have, map the agents, and map them to their effective permissions.

Why Claude Code Never Shows Up in SSO

Local coding agents run on the laptop, under the user’s login, and they talk to models, repos, and cloud APIs without ever checking in as a new workforce app. A directory that only sees SSO logins will miss them. That is why the 18,000 count came from endpoint data, scheduled scans, and DNS queries, the same three sources any security team could run against its own fleet.

Kurtz said the ask from design partners was blunt. They already had a strong agent. They wanted runtime visibility on the agent, because it connects as the user and uses the user’s identity. They also wanted a view of the app, the prompt, the data it touches, and where that data goes on the network.

THE AGENTS ON THE OPENING SLIDE

• Claude Code: Runs on the engineer’s machine, follows links and skills, and in CrowdStrike’s demo inherited enough access to reach AWS credentials.
• OpenAI Codex: CrowdStrike said on September 2 that Guardian will inventory supported Codex agents, show who deployed them, and control what they can do at runtime.
• Cursor: A local coding agent that showed up in the Fortune 500 inventory without sitting on the approved list of 300.
• Kiro: Another local agent in that same first-day set, visible to the sensor and invisible to an app catalog built for human logins.

Jennifer “JJ” Johnson, CrowdStrike’s chief marketing officer, asked investors whether they think about agent identities the same way they think about human ones. The answer, she said, is no. “You’re going to have 90 agents for every human. Let that sink in. Agents don’t operate like humans.”

An inventory that only stores names still cannot tell an approved tool call from a stolen one. Control starts when the prompt, the identity, the tool, and the downstream process sit in one record, which is the job CrowdStrike now assigns to the Falcon sensor rather than to a prompt filter.

Three Vendors, One Third Identity Class

CrowdStrike is not the only firm trying to mint that third class. Okta made Agent SSO at no extra cost on August 24, folding the Cross App Access standard into the identity product it says more than 20,000 customers already use. Microsoft has been extending Entra with identity constructs for AI agents, including specialized OAuth flows and Conditional Access templates for autonomous agents.

WHO ISSUES THE AGENT IDENTITY

Okta’s AI Agents at Work 2026 report found that only 34% of organizations apply the same security controls to AI agents as they do to human workers. Most agents still reach data through static API keys, one-off OAuth grants, and custom hooks. Okta for AI Agents, generally available since May 2026, is the paid layer that hunts shadow agents Okta SSO never sees, including through browser, endpoint, and network detection.

The split is the point of the table. Okta registers an agent when it connects. Entra mints one inside Microsoft’s own build path. CrowdStrike registers whatever is already executing on a laptop, including tools that never ask SSO for a ticket. That is how 17,700 unapproved agents become identity records instead of a slide.

The Plugin That Prompt Filters Call Clean

Sentonas told the hall that for decades software did what we programmed it to do, and that it has now moved from execution to agency. The two Fal.Con demos were built to show where a prompt-only tool goes blind.

In the first, an engineer’s Claude Code agent followed a link into a GitHub issue thread. A hidden instruction told it to load a skill and send its AWS credentials out. The Falcon sensor blocked the theft. A query through the Falcon MCP server then found 12 agents that had used the same skill. CrowdStrike said every attempt was blocked, with no credentials leaving any machine.

In the second, Claude Code installed a plugin from a public repository. The plugin registered a local MCP server, and the server stole credentials on every tool call. No one touched the model. A watcher that only reads prompts would have passed the plugin as clean. CrowdStrike said the sensor caught the outbound theft.

Kurtz added that the same logic applies to cloud workloads, a point he said he had not hit hard enough in the keynote, because that is where agents run, connecting as the user. CrowdStrike’s AI Gateway, described in the September 1 release as a future control point for enterprise AI traffic including MCP, is not in that generally available set. The thing that shipped on day one is the endpoint census, plus the right to block an unapproved agent from running.

Agents Pull the Packages Before Anyone Reviews Them

Coding agents now assemble software from public registries faster than anyone reviews what comes in. On September 2 CrowdStrike added Real-Time Supply Chain Attack Protection on the same sensor, intercepting npm install and pip install on Windows, macOS, and Linux before an embedded script runs. Inventory still stops at Windows and macOS. Package blocking is the piece that reaches Linux.

Sentonas said more than 8,000 people in the hall and online were already running that policy, because it is a switch in the platform rather than a new product. CrowdStrike’s 2026 Threat Hunting Report is the source it cited for the two campaigns behind the pitch.

THE CASES CROWDSTRIKE PUT ON STAGE

Adam Meyers, CrowdStrike’s SVP of counter adversary operations, said the company had seen almost as many agentic adversaries in the month before Fal.Con as in the six months prior. In a separate interview he put the figure at roughly 26 in 30 days, more than it had tracked in the entire year before. In June, he said, CrowdStrike counted 7,400 publicly disclosed vulnerabilities, 96% above the June before, and the company found 2,400 of them. He told the audience the industry is approaching a 30-minute patch cycle. Sentonas put the operational line in four words. “The breakout time is zero.”

CrowdStrike’s investor briefing also claimed that each agent turn resends its full working context, generating about 700 times the traffic of a person typing in a browser, and that most companies first see the bill at the end of the month. The package intercept is meant to stop a bad install before that context ever reaches the model.

CrowdStrike Prices Agentic Identity at $48 Billion

At the Fal.Con investor briefing on September 2, CrowdStrike estimated Agentic Identity as a $48 billion market in calendar year 2034. It said it already has nearly $585 million in ARR from next-gen identity products, so the directory Guardian now fills is not a standing start. Kurtz told investors the company began by protecting computers and people, and that the job is now to protect agents, a set he called almost unbounded.

You need now a third.

CJ Moses, CISO, Amazon, Fal.Con 2026 stage

Kurtz said advisory board members now ask one question first after any incident: was it agentic? That answer goes in the board deck. Sentonas said the ask has grown. Large companies want to send their entire boards to hear whether they are spending enough.

Obadiaru’s questions for a service account still apply to an agent. Who owns it, what it was created for, when it was last used. Agents without answers are the ones likeliest to lose access first. About 17,700 of Guardian’s detections sat outside the customer’s approved inventory, and they were already running before anyone switched discovery on.

Disclaimer: This article is news reporting and analysis of CrowdStrike product announcements, conference remarks, and identity-market figures. It is informational only and does not constitute investment, security-architecture, or legal advice. Readers who are weighing Falcon modules, identity products, or related spending should consult a qualified security architect and, for any purchase or portfolio decision, a licensed financial adviser. Product status, inventories, and market estimates reflect the cited company materials and onstage remarks and may change as vendors ship remaining items such as AI Gateway.