CrowdStrike buys Fiddler and Dreadnode to police AI agents

CrowdStrike just put a price on the question every agent builder dodges: what did it do, and can you stop it?

CrowdStrike announced on November 3 definitive agreements to buy Fiddler AI, which monitors AI agents, and Dreadnode, which tests AI models for security flaws. The same day it launched an AI Kill Switch for agents that misbehave.

Two deals and a kill switch

CrowdStrike did not disclose prices. The Wall Street Journal reported about $400 million for Fiddler and about $95 million for Dreadnode, according to TechCrunch.

About $495 million in total.

CrowdStrike says the Fiddler purchase is mostly cash with a portion in stock subject to vesting, and expects it to close in its fourth quarter of fiscal 2027.

Fiddler will be sold inside CrowdStrike's Falcon platform as Falcon Observe. The company says it evaluates agent accuracy and policy compliance before deployment, traces agent decisions and tool calls, detects drift and hallucinations in production, and tracks token use and spend. It instruments agents through OpenTelemetry and supports LangGraph, Amazon Bedrock, AWS Strands and Google ADK.

Dreadnode, founded in 2023, has raised $14 million, TechCrunch reports. Its testing results will feed into Falcon Guardian as security policy recommendations.

The kill switch is the part you can use today

The AI Kill Switch lets an authorized administrator stop a running agent, block it from relaunching on a host or group of hosts, and cut its access to enterprise networks, according to CrowdStrike. Every action is recorded in an audit trail.

CrowdStrike says it is available now at the Gateway. Stopping agents directly on the endpoint is coming "soon."

"Fiddler is the flight recorder for every agent," CrowdStrike CEO George Kurtz said in the release.

Why this lands now

Agents went from demo to deployment faster than the controls around them.

TopFive reported last week that CrowdStrike says one operator steered AI agents at more than 200 organizations. That kind of finding is what sells products like these.

Security teams already know how to log a server and quarantine a laptop. An agent that reads email, calls APIs and spends tokens on its own needs the same treatment. CrowdStrike is betting buyers want it from the vendor already installed on their machines.

Fair to say this is also a sales pitch: the company warning you about rogue agents is the one selling the fix. The deals still put real money behind a real gap.

What it means if you build or run agents

Your agents are about to be audited, by your own security team if not by a vendor.

Three questions will come first. Can you show every tool call an agent made? Can you explain why it made it? Can you stop it in seconds without pulling the network cable?

If you build agents for enterprise customers, expect those questions in procurement. Emit OpenTelemetry traces now, scope each agent's permissions as tightly as you can, and keep an agent sandbox between it and anything you cannot undo.

What to watch

Falcon Observe is due to be generally available in CrowdStrike's fourth fiscal quarter of 2027. Endpoint termination for the kill switch has no date.

Watch which agent frameworks CrowdStrike adds next. Build your own off switch before then.