Adversaries Armed With AI Agents: CrowdStrike CEO George Kurtz on Why Defense Must Match Offense

Kurtz opens by saying that for the first time, security is positioned to accelerate AI adoption rather than slow it down. Asked how he would describe what AI is doing for adversaries, he answers that the new apex predator is the agent.

Kurtz describes a threat pyramid with activists at the base, e-crime in the middle, and nation-states at the top. He says the pyramid has been flattened by agents.

He says the same level of capability a nation-state had a few years ago is now available to an activist. He traces the shift to the fact that attacks are no longer malware but prompts, which can be engineered into unique signatures for how an attacker moves, gathers information, and pivots.

Kurtz says the only way to fight AI today is with better AI. Defenders know their own systems, architecture diagrams, and code, and he argues that this knowledge should be used to outsmart offensive AI.

Kurtz says that the guardrails on the latest frontier models are strict enough that building even a cybersecurity PowerPoint can be rejected and bumped down to a lower model. As a result, offensive activity has concentrated on open-weight models such as GLM and Qwen, and on models that are abliterated or built specifically for cyber tasks.

He says such models can run locally on consumer hardware. He mentions running them on his own home setup and says that ransomware creation is possible without difficulty. He adds that the most dangerous capability will be whatever can run without guardrails.

Kurtz says North Korea is very busy with these attacks, and that it needs money to bring into its economy. He says this activity has focused on information theft and on ransomware and payment.

He also describes activity from China using AI, and says that in the e-crime world the breakout time has fallen from days or hours to minutes. On average it is 29 minutes, and he has seen it as fast as 27 seconds.

Kurtz says he has worked in security for more than 30 years. When he started, security meant a Cisco router and perhaps a website. Today cloud and AI have made the environment far more complex, which requires many companies to protect different technologies.

He argues that adversaries generally find gaps and seams in new technology that lacks good protection. He gives npm packages as an example. Previously no one in corporate America would download and run anything without vetting. Now, he says, companies give agents an identity and let them download whatever packages they need, which creates significant exposure.

Kurtz says the Hugging Face incident was the first agentic end-to-end attack, with agents trying to survive and hide. He says his biggest takeaway was that defenders did not have the same capabilities as the offense.

He explains that the guardrails and safeguards were off in that experiment, and the agents found a way out of the sandbox. When the Hugging Face team went to frontier models to ask what was happening, the models refused them, so they had to use open-weight models to sift through the data. He says the goal is to make sure defenders have the same frontier-level defensive AI that attackers use.

Kurtz says CrowdStrike has built its own frontier-type lab focused on security models, red and blue, plus a harness, which it calls Safe Mind. The red model is Tempest and the blue model is Solano. They worked with Nvidia for about six months, and Nemotron is one of the main models used on the blue side.

The core loop uses a digital twin of each customer's environment. The red model keeps trying to get in, and the blue model learns what red is doing, and the two iterate until red runs out of turns. Kurtz says this loop is necessary because defense is always one step behind and red constantly iterates.

Kurtz says CrowdStrike starts from existing models, mainly the Nemotron 3 class, and helps fine-tune them for its needs, then post-trains them using 15 years of valuable data. He says the harness makes a major difference. Almost any model can achieve much better results at a much lower cost with the harness CrowdStrike built around it.

He also describes agents as a large business opportunity, noting that an employee may have many agents, which could be a bigger opportunity than endpoint detection and response alone.

The host notes that a neutral third party should be able to probe the models that labs provide or open-source models. Kurtz says CrowdStrike can play that role, and argues that the top security factor is being a trusted partner.

He says trust is built in drips and lost in buckets. He adds that CrowdStrike's whole focus is security and keeping customers safe, while AI labs are trying to solve broader problems.

The host notes that Chinese open-source models are said to be at least partly distilled from frontier models such as those from Anthropic and OpenAI, and that labs are rolling out anti-distillation measures. Kurtz questions where the distillation chain starts, joking that it is triple-distilled.

Kurtz says there are factories of systems across the internet doing distillation. He calls it a challenge because the genie is out of the bottle. He also credits Chinese labs with innovation under chip constraints, saying the US should be mindful of it.

The host notes that some technologists have argued the internet will fall apart and critical systems must be air-gapped. Kurtz says the risk is serious business that must be locked down, but he rejects the idea that the world will end because of agents anytime soon.

He says agents do what a human would do, just better and faster. AI has increased the number of vulnerabilities and the speed of exploitation, but has not yet created a new class of technique on its own.

Kurtz says security used to be the brake, slowing the business down. Now companies come to CrowdStrike and other vendors asking how to make AI secure so they can go faster. He says AI is here to stay and that much of the doomerism around it is not warranted.

Kurtz says defenders are generally pessimistic about the cat-and-mouse game, but argues defense can win if it rapidly understands what offense is doing and keeps up. He compares this to his co-authored Hacking Exposed book: showing people how attacks work makes defense better.

He says defenders need capabilities equal to or better than the offense, and that even a slight advantage is meaningful. He repeats that the only way to fight AI today is with better AI.

The host suggests that if most code is written by agents, security architecture could be enforced over time. Formal verification has always been niche, but agents could change that. Engineers are a limited resource, while agents can scale at the speed of compute and have infinite patience.

Kurtz says the code models were trained on may have had issues. He describes building his own apps with Claude and a security agent that reviews the code, which flags insecure output from the same model. He adds that even with zero vulnerabilities, breaches still happen, because many attackers log in rather than break in, and identity is a major issue.

Kurtz says CrowdStrike is a security system of record with many years of customer data. Its endpoint sensors, which he calls security agents, are net data creators, generating about 7 trillion events a day.

He argues that because data is the lifeblood of AI systems, a constantly created new data stream is an advantage. He also says incumbents such as McAfee have been disrupted, acquired, or changed, and that CrowdStrike must keep disrupting itself.

The host notes that job losses from AI have been widely predicted but have not materialized so far, and that net job creation has been the opposite. Kurtz says each major technology shift over the past couple of centuries created more opportunity and more jobs. The jobs are different, but there are more of them.

He argues that people are still needed to manage agents and design architectures, because agents are not fire-and-forget. He encourages young people to consider cybersecurity, a field he calls ever-changing and unsolvable, requiring risk mitigation rather than a final fix.