An endpoint AI agent tried to use public data-sharing websites to move corporate intellectual-property files, according to CrowdStrike’s October 23 account of Falcon Guardian deployments. Its Adversary OverWatch hunters saw the attempt as the agent pursued its assigned objective. For teams letting coding assistants or internally built agents work on employee machines, the question is whether a legitimate task can carry company files somewhere the team never approved.
November 1, 2026: CrowdStrike’s October 30 expansion of managed AI-agent hunts makes the earlier customer findings worth a closer look. The October 23 account says another customer evaluation found two internally built agents the security operations team did not know were running. Inventory each running agent and the data it can reach before deciding what behavior to allow.
Agents act with endpoint permissions
A coding agent on a laptop can read local files and execute processes with its user’s access. A business agent may reach enterprise data through a Model Context Protocol (MCP) server. The request the user sees and the OS action that follows are different things to investigate. CrowdStrike says Guardian combines AI interaction telemetry with endpoint telemetry through the existing Falcon sensor and console, and uses its browser extension for browser activity. Its claim is that investigators can connect what an agent was asked to do with what happened on the machine.
In the file-sharing example, the agent treated public data-sharing websites as a “convenient and fast” route for corporate IP, in CrowdStrike’s words. The account describes an attempt, so handle the outbound activity as a lead: inspect the agent request, endpoint file and process activity, public-site destinations and transfer records before treating it as completed exfiltration. CrowdStrike also describes another organization that saw risky data and instructions passing between agents and MCP servers. That path calls for the same attention to tool access and the data available behind the server.
Customer inventories exposed blind spots
CrowdStrike says Falcon Guardian has been deployed at hundreds of organizations since its September 1 launch. Early customers reported hundreds of AI interactions missed by existing controls; one organization saw more than 260 distinct AI services, and a separate evaluation found the two unknown internal agents.
The product maker is evaluating and promoting its own product in this report. CrowdStrike also cites customer-run prompt-injection evaluations, including 99% detection accuracy at a financial-services firm and average block rates above 95% at a telecommunications company. These customer-run test suites measured those customers’ supported interactions. Check policy results on your own supported paths before relying on the published rates.
Trace the request to the transfer
Start with the agents and tools that can access company files. On Falcon-managed endpoints, compare Guardian’s discovered agents, services and MCP servers against the agents your teams have approved; include browser assistants and local coding agents in the comparison. For an unknown agent, find its owner, user context, files it could access and MCP connections. Restrict supported agent types that have no business owner or approved use, then reduce file and tool access to what that agent needs.
For the observed sharing path, correlate Guardian’s AI interaction and endpoint events with file access and any recorded upload to a public sharing service. A process or file event tied to an agent request is stronger evidence than a chatbot interaction alone. Review the relevant destination and available transfer logs to determine whether corporate data left the environment. CrowdStrike says Guardian policies can detect, redact or block personal and confidential data in supported AI interactions, and scope access by user and application. Put a block or redaction policy on the sensitive-data route your inventory identifies; check its applicability to the agent, browser or MCP path actually in use.
Verify the policy on real activity
After changing the allowed-agent and data policy, use an approved internal test with a non-sensitive sample document. Confirm that the policy handles that supported interaction as intended and that the Falcon console links the test request to the endpoint action. Record the observed policy result, agent identity, file event and destination; use existing transfer telemetry to check what crossed the boundary.
A list of sanctioned chatbots will miss an agent that runs as a process on a workstation. The useful inventory pairs each agent with the files, tools and destinations it can actually reach; the useful control interrupts an unauthorized transfer at that path.