CrowdStrike announced on November 4, 2026, at Fal.Con Europe in Barcelona that it will add Agent Insider Threat Detection to Falcon Next-Gen SIEM in Q4. The announcement pairs that forthcoming capability with generally available coordinated multi-agent investigations, connecting behavioral alerts to cross-domain investigation and response.
The target case is an enterprise agent with system-level access to sensitive data and the autonomy to act on it. If that agent is manipulated or drifts from its intended behavior without violating a rule, policy- and log-based tools have no explicit violation to catch. They can also struggle to distinguish the agent’s actions from those of the person running it, leaving a behavioral problem that can appear legitimate at the level of individual events.
Agent Insider Threat Detection is designed to learn normal behavior for each AI agent and its owner, then flag deviations even when no policy is violated. It adds that risk to the score Falcon Next-Gen SIEM builds for the owner and host, and routes abnormal behavior directly into a coordinated investigation. The trigger therefore moves beyond a broken rule to a change in behavior, with identity and host context carried into the investigation.
Coordinated Investigations Reach General Availability
The investigations now generally available were unveiled on September 2, 2026, at Fal.Con in Las Vegas. Charlotte AI dispatches expert-trained agents in parallel across endpoint, identity, SaaS, cloud and network domains. They work on a shared context layer rather than conducting isolated inquiries, then converge on a verdict with visible reasoning and justification.
That design addresses the assembly problem in cross-domain investigations. Analysts can examine the agents’ reasoning instead of manually stitching together findings from separate domains, while shared context allows information learned by one agent to inform the others working on the same investigation.
Detection and investigation feed a response layer that includes the Falcon Guardian AI Kill Switch, which terminates an agent. Analysts also have Agent Interruption to pause or stop a running Charlotte AI or AgentWorks agent mid-task, a control intended to prevent unauthorized action and runaway spending.
Human Controls and the Next Detection Phase
Charlotte Agentic SOAR is available as a single governed workspace for agents, workflows and custom applications, with autonomy settings ranging from human approval to fully autonomous execution. Its human-in-the-loop gates pause an agent when it invokes a sensitive tool and raise an Action Request. Analysts can approve the action, reject it with a documented reason or inspect the full agent trace, creating a reviewable decision point around tools that warrant closer control.
Several related controls are listed for the same Q4 roadmap. AI Ecosystem Detections are intended to cover LLM API abuse, stolen API keys, and compromises involving coding assistants, MCP servers and agent frameworks. Approval gates are planned to extend from individual tool calls to entire agents, applications and workflows.
AI Credit Visibility and Control is designed to provide real-time consumption visibility, mid-run halts and decisions on whether to raise or deny limits when an agent reaches its cap. That places spending controls alongside security approvals, giving administrators a way to interrupt autonomous work when its resource consumption becomes unacceptable.
A later item, Policy-Drift Agent Guardrails, is scheduled for the first quarter of fiscal 2028. Falcon Guardian would screen Charlotte AI and AgentWorks interactions for policy drift, unauthorized tool calls and out-of-bounds data access. The unreleased services and features remain in development and subject to change, making these labels and schedules a roadmap rather than current availability.
The release assembles an agent-security workflow in stages: coordinated investigation and operator controls are available now, behavioral detection is listed for Q4, and policy-drift guardrails sit further out. For defenders, that leaves a practical distinction between reviewing or stopping an agent’s action and identifying the subtle behavioral change that should trigger the response.