CrowdStrike launches AI agents that do security alert work

CrowdStrike launched its new Agentic Security Platform in its 2026 Fall release, after its conference in September. Its AI software agents, which work with no person, look into security alerts across computers, identities and cloud services. SafeMind, a system, tests a copy of the live network for weak points, but the source gives no test results.

How it works

Agents look into alerts. Teams can use pre-built agents or make agents with a tool that works with no code. On paper, this removes basic work, such as some Level 2 investigation and Level 3 repair.

SafeMind uses an open-weight model from Nvidia. An attack part and a defense part test an isolated copy of the network all the time.

The numbers

The source gives no test results. It says the agents make alert work fast, but only on paper.

What is not known

Chris Cochran of the SANS Institute says agents will help analysts and not replace them for some years. Cochran says a team must get the same task from the same input. Agents do not always do this.

Cochran says teams must test agents with known good and known bad inputs. James Patrick says teams must set which person or system has authority, and make sure of it.

Insight: CrowdStrike sells the agents, the stop switch and the threat

CrowdStrike sells agents for the security team. It also added a kill switch that cuts agent access to AI models. In late October it said a China-linked group used agents that look for computers with no CrowdStrike sensor. This reads as a push for one sensor on each computer, and one vendor describes the threat and the cure. Get proof from a source other than CrowdStrike.