CrowdStrike Agent Graph Shows How Agents Act on the Endpoint
CrowdStrike, Friday, October 30th, 2026
CrowdStrike Agent Graph traces AI agent sessions on the endpoint from prompt to impact, showing what agents actually did.
CrowdStrike says AI agents now open files, use credentials, run code and install software at machine speed, and network gateways only see the conversation, not what happens on the machine.
With Falcon Guardian the existing Falcon sensor also sees prompts, models, tools and skills, and Agent Graph links that AI layer to processes, files and network activity in one causal chain.
Agent Graph is the relational layer behind three Guardian views: agent inventory, session graph and agent threat score, mapping each agent to users, hosts, MCP servers and detections.