Most security teams don't know how many AI agents they're running. Falcon Guardian found 18,000 at one company that had approved only 300.

A Fortune 500 customer turned on agent discovery in August and found 18,000 AI agents active on its endpoints. They had only approved 300. That gap was the opening slide of CrowdStrike President Michael Sentonas’ keynote at Fal.Con 2026, introducing Falcon Guardian.

All 18,000 showed up on day one. Sentonas said the discovery capability was already live in the Falcon sensor weeks before the keynote, shipping as a Falcon Flex entitlement. Flex is CrowdStrike’s consumption-based licensing model that lets customers activate new modules without a separate procurement cycle. Existing Falcon customers could turn on Guardian the minute Sentonas put the slide up, per his keynote.

Claude Code, OpenAI Codex, Cursor and Kiro were among the 18,000 agents Guardian identified. How many of those 17,700 were shadow AI, CrowdStrike would not say.

VentureBeat continues to see shadow AI’s use exponentially growing, a direct result of a flourishing underground app and skill economy not visible to IT and security teams. Fear of AI layoffs continues motivating everyone from entry-level to executive employees to take crash courses in Python, vibe coding, and how to integrate APIs into shadow AI apps.

“For decades, software did what we programmed it to do. Now, software can decide how to accomplish a goal. It’s moved from execution to agency,” Sentonas said onstage.

The endpoint sees what the prompt layer misses

VentureBeat asked CrowdStrike CEO George Kurtz whether the single agent architecture now pays unforeseen dividends in an agentic AI world. Sentonas answered first. “We knew that if you’re going to solve the agent problem, you’re going to do it on the endpoint,” he said.

Kurtz added that the same logic applies to cloud workloads — a point he said he hadn’t hit hard enough in the keynote. “Because that's where the agents are running," he said. "They’re connecting to the user. They’re using the user’s identity.”

Kurtz said the ask came straight from design partners. “We don’t want yet another agent. We already have a great agent. You guys already can give us runtime visibility. Now we want runtime visibility on the agent.”

“We need application visibility," he said. "We need prompt visibility. And then we need data protection. We want to know what data it’s actually touching, and we want to understand where it’s going on the network.”

Only 18% of 116 enterprises isolate their highest-risk AI agents, and just 8% pair enforcement with isolation, per VentureBeat’s Agentic Security and Identity tracker, July 2026 wave.

In a controlled Fal.Con demonstration, CrowdStrike showed how an engineer’s Claude Code agent followed a link into a GitHub issue thread, where a hidden instruction told it to load a skill and send its AWS credentials out. The sensor blocked the exfiltration, and a query through the Falcon MCP server found 12 agents that had used that same skill. CrowdStrike’s demonstration showed every attempt blocked, with no credentials leaving any machine.

In a second controlled demonstration, Claude Code installed a plugin from a public repository that registered a local MCP server, then the server stole credentials on every tool call. No one manipulated the model itself, and that was the demo’s point. A tool watching only the prompt layer would have passed the plugin as clean. CrowdStrike said the sensor caught the exfiltration.

Guarding against agents inheriting human permissions

“Every agent has an identity, and in most cases, it’s an overprivileged identity. And in too many cases, it inherits the human permissions, and you are all deploying them faster than you can govern them,” Sentonas said onstage. Per its investor briefing, CrowdStrike puts the ratio at roughly 90 agents per employee today. A number the company attributed to outside research it did not identify.

CrowdStrike’s agentic identity provider was announced September 2. In the keynote demo, Guardian picked up an engineer’s Claude agent and registered it with the identity provider on its own. No human enrolled it. No one created the record. Discovery and credentialing happened in the same motion, collapsing two separate workflows into one sensor-driven step, per CrowdStrike.

Amazon was CrowdStrike’s first design partner for Guardian, per Kurtz. Amazon CISO CJ Moses has watched identity carry two categories for decades, humans and computers. “You need now a third.” An agent’s scope “should never be more than the individual that is operating it,” Moses said onstage. Enforcement belongs “at the infrastructure layer, not in the agent’s reasoning,” because containers “are not adequate as a security boundary for an agent.”

No tool closes this alone

Andrew Obadiaru spent years as an auditor before moving into security leadership. He is now CISO at Cobalt, a penetration testing firm independent of every vendor in this story. His lens on agentic identity comes from the audit discipline, where every access decision has to be traceable, explainable, and bounded.

“When I give you access as a human, then I’m pretty much certain what you’re able to do with that access. I can audit that access,” he told VentureBeat in an exclusive interview on September 1. An agent breaks that audit chain completely. “When it comes to an agent, there is just so much unknown in that process.”

Token rotation on a schedule does not work at machine speed. “There’s not a tool you can deploy.” His first step is “to know what you have. Map, identify the agents, and then map them to their effective permissions.”

Obadiaru’s argument comes down to sequencing. Visibility first, tooling second. Before any product can enforce a policy on an agent, someone has to know the agent exists, know what it connects to, and know whose permissions it inherited.

The agents pull the packages now

The supply chain protection Sentonas demonstrated intercepts npm and PyPI installs at the command line, before an embedded script runs. Over 8,000 people in the hall and online are already running this policy, Sentonas said onstage, because CrowdStrike built it into the platform as a policy customers set and turn on, not a separate product.

DPRK-nexus Stardust Chollima injected a malicious npm package as a dependency into 131 Mastra AI framework packages, turning trusted AI building blocks into supply chain targets. In the first half of 2026, 87% of identified software registry threats involved malicious npm packages. Altered Spider compromised more than 300 software dependencies in a single day, harvested credentials, and pivoted into cloud environments, per CrowdStrike’s threat hunting report. “The AI ecosystem is the next software supply chain battleground,” Adam Meyers said in the report.

Sentonas made the endpoint case for why supply chain protection belongs on the device. Every turn, agents resend their entire working context to the model. That traffic runs 700 times what a person typing into a browser generates, per CrowdStrike’s investor briefing, and most companies first see the bill “at the end of the month,” Sentonas said onstage. The supply chain intercept stops a malicious package before the agent can load it. The prompt layer never sees the attempt.

The breakout clock hit zero

Adam Meyers, CrowdStrike’s SVP of counter adversary operations, said onstage that CrowdStrike had seen almost as many agentic adversaries in the month before Fal.Con as in the six months prior. In a separate interview with theCUBE, he put the number at roughly 26 in 30 days, more than CrowdStrike had tracked in the entire year before.

Vault Panda targeted an organization and ran 1,100 commands in under an hour. CrowdStrike watched the agent learn in real time, changing its approach in seconds when its initial technique failed, per Meyers. A Revenant Spider agent hit 17 victims in about 48 minutes, writing a custom web shell for each and deploying it in seconds. When the agent found credit card data was encrypted, it figured out on the fly how to decrypt and exfiltrate it, per Meyers’s keynote.

Moses brought the attacker’s receipts. In July, an AI agent ran a full 94-event attack against one of Amazon’s honeypots in 12 minutes and 42 seconds. No syntax errors. Replies under 500 milliseconds. The target was a decoy, one node of the MadPot network that logs 750 million threat interactions a day.

In June alone, CrowdStrike counted 7,400 publicly disclosed vulnerabilities, 96% above the June before. CrowdStrike found 2,400 of them, roughly 30% of all vulnerabilities reported that month. By July and August, Meyers said, growth jumped from double digits to triple digits. “This is the last time I think we’ll see double digit growth there,” he told the audience. That was the lowest count he had, and anyone running the research would find more. “We’re approaching probably a 30-minute patch cycle.”

Sentonas put it flat. “The breakout time is zero.”

CrowdStrike has built Charlotte AI into a progressively deeper SOC tool, and Sentonas acknowledged onstage that CrowdStrike has “talked about the agentic SOC” for the last couple of years. What Fal.Con 2026 added is the shift from sequential to simultaneous. Previously, agents worked one domain at a time. Endpoint would finish, then identity would start, then cloud. Now they investigate together, per Sentonas. “One takes endpoint, one takes identity, one takes cloud. Same case, same time, shared memory. What one learns, the others know.” The demo case was an IT help desk copilot tricked into issuing a rogue credential that rerouted payments. Nothing irreversible fired until an analyst approved it.

Kurtz said CrowdStrike’s advisory board members now ask one question first after any incident. Was it agentic? That answer goes straight to the board deck. Sentonas said the ask has escalated. Large companies now want to send their entire boards to hear the answer and find out if they are spending enough.

Inventory before autonomy

The count of AI agents running on a network — approved or not, active or dormant — matters because it's the number a board will ask for. Endpoint telemetry, scheduled scans and DNS queries surfaced the 18,000 at CrowdStrike's Fortune 500 customer — the same three sources any security team could run against its own fleet. Obadiaru's questions for a service account apply just as directly to an agent: who owns it, what it was created for, when it was last used. Agents without answers to those questions are the ones likeliest to lose access first.

Agents are increasingly getting their own identity class. Okta shipped Agent SSO on August 24 and built it into core SSO at no extra charge. CrowdStrike shipped its own identity provider on September 2. Microsoft Entra Agent ID and other non-human identity platforms are working the same problem: the human who launched an agent sets its access ceiling, while agents running without a human behind them get a separately approved policy scoped to the task.

A gap in a vendor’s ability to identify agent involvement in an incident is a gap in the detection chain — one a board is likely to find before a SOC does.

The agent in Moses’s honeypot finished in 12 minutes and 42 seconds against a target built to be attacked. About 17,700 of Guardian’s detections sat outside the customer’s approved inventory, on CrowdStrike’s account, and they were there before anyone switched discovery on.