An AI agent doesn’t need to be malicious to cause damage. It just needs to reason its way into the wrong system, the way a well-meaning agent handling a finance report might decide it needs a code repository it was never meant to touch. Limiting what that agent can reach if it goes wrong, known in the industry as its blast radius, is becoming one of the harder problems in enterprise security.
AJ Shipley (pictured), chief product officer at CrowdStrike Holdings Inc., joined theCUBE’s Fal.Con coverage for the first time this year. Shipley led the press briefing behind several announcements aimed at that problem, including Falcon Guardian, the AI security product born out of CrowdStrike’s acquisition of Pangea.
“The primary attack surface was a human sitting at a keyboard, putting a prompt into a browser to go to a chat agent and get a response back,” Shipley said. “First and foremost, we needed to get that visibility into all of the agents that were operating in an environment.”
Shipley spoke with theCUBE’s Rebecca Knight and Dave Vellante at Fal.Con, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how Falcon Guardian and CrowdStrike’s Agentic IdP work together to contain an AI agent’s blast radius. (* Disclosure below.)
How zero standing privileges shrink an agent’s blast radius
Shipley walked through a hypothetical in which an employee in finance asks an AI assistant for a report, and the agent reasons its way into requesting access to a developer’s code repository, a system the employee herself should never touch. Because Agentic IdP assigns each agent a unique identity and only grants access for the length of a task, that agent can never hold more privilege than the person who spun it up. Falcon Guardian, the product Shipley traced to CrowdStrike’s Pangea acquisition, supplies the visibility layer that feeds Agentic IdP.
“If you take Hugging Face and the 1,000 or 1,200 or 1,400 agents that were swarming to the problem, Guardian gives us that visibility in real time,” Shipley said. “Through our Agentic IdP, we can assign a unique identifier to each one, so they are not able to collaborate and access systems together if they shouldn’t have those privileges to begin with.”
Shipley said the system isn’t foolproof. Asked whether there’s a kill switch for a rogue agent, he said CrowdStrike doesn’t have one today, at least not in the form customers might expect, though it’s worth exploring. Accountability, he said, sits with the customer in the meantime.
“It is shared responsibility,” Shipley said. “We have a responsibility as a vendor, but the customer also has a responsibility to help provide context that we can use to make better decisions. Only a customer would know what the criticality of an asset in their environment is.”
Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the Fal.Con event:
(* Disclosure: TheCUBE is a paid media partner for the Fal.Con event. Neither CrowdStrike, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)
