AI Agents Are Now Acting on Their Own: Why Visibility Is the First Step to Securing Them

AI is moving from a tool that generates content to agents that reason, decide and take action on their own. Employees use AI assistants in browsers and desktop apps, developers run coding agents that read files and execute commands, and business teams connect agents to company data through Model Context Protocol (MCP) servers. This raises hard questions for security teams: which agents are running, who deployed them, what can they access, and what are they doing?

CrowdStrike reports that its Falcon Guardian product has been deployed at hundreds of organisations across sectors including financial services, healthcare, manufacturing, retail, energy and the public sector since launch. According to the company, the first challenge for most customers was visibility. Security leaders knew AI use was widespread but could not see which agents and tools were in use, what data was going into prompts, or which tools were approved and which were unsanctioned "shadow AI".

CrowdStrike says Falcon Guardian discovers AI use across endpoint, cloud and SaaS environments, and that visibility can arrive within minutes for customers already running the Falcon sensor. It notes that AI agents act through the same processes, files and user permissions that are already protected, and the product works through the existing sensor, console and a browser extension. This is a vendor account of customer experiences, and only the opening of the article was covered here.