Hackathon Shows What Good Security AI Agents Look Like, and Finds Hidden Risks Along the Way

CrowdStrike, working with NVIDIA, ran the first AgentWorks Hackathon to show what well-built security AI agents look like in practice. Security teams were invited to nominate agents they had built using Charlotte AI AgentWorks, a no-code workspace on the Falcon platform. Nearly a hundred nominations arrived from more than 50 countries. CrowdStrike says the standouts were intentionally designed, governed by clear guardrails, and delivered real impact.

One winning agent, called Agent Smith, tackles a blind spot many teams share. AI coding tools can start an MCP server on a developer laptop with a single command, and most security teams have no inventory of them. In one day, one company found 1,710 hosts running unapproved MCP servers. These included a revoked server, unapproved mailbox readers, and one with TLS verification turned off. Agent Smith finds MCP servers on endpoints, checks each against the organisation's approved list, and reviews redacted command lines for risky settings. The result is a daily inventory with a clear next step for every server.

This article covers only the opening of CrowdStrike's write-up, which promises five lessons for security teams. The rest of the winning agents and lessons are not covered here.