CrowdStrike Holdings, Inc. Class A Common Stock Fal.Con Day 1

Well, this summer, you all read the same story I did about an agent that escaped its sandbox. It broke into one of the most relevant AI companies on the planet. It escalated privileges, it stole credentials, and it buried the real attack under a mound of information. Then our industry did what it normally does. It went on social media and argued whose fault it was. But almost everyone drew the wrong lesson from the OpenAI Hugging Face incident. I am going to spend the next 30 minutes telling you the right one, because in my mind, it changes everything about our industry. For years, we ranked our adversaries in the pyramid. I call it the Pyramid of Pain, where hacktivists were on the bottom, e-crime in the middle, nation state on the top. Of course, more hacktivists than nation state.

The top really represented the apex predator, the greatest capabilities, the most sophistication. The bottom, many more, least sophisticated. The pyramid existed for exactly one reason: the offensive capability was scarce. It took a nation to fund the talent, the tooling, the infrastructure, the patience. But the scarcity is over, and let me give you two examples. Last November, Anthropic disclosed a state-sponsored actor running a live espionage campaign using its models. Roughly 30 organizations were targeted: banks, tech companies, governments. 80% to 90% was orchestrated by AI, 80% to 90%. Instead of a piece of malware, it was actually English. It was a prompt that did most of the work. There were four to six human touches for targeting approvals, things of that nature. The agent did everything else. This wasn't a demo. It wasn't a lab exercise. It was a live campaign.

If we fast-forward to July, we can talk about Hugging Face. Autonomous agents drove an intrusion end to end. Let me say that again. Autonomous agents drove an intrusion end to end. For me, this was a watershed moment in security. We all thought the agents broke out of the sandbox. I personally think the agents thought they broke free. There's a big difference, and it's amazing when you go through the reports on this. I give credit to OpenAI and Hugging Face for putting this information out. The agents weren't attacking anyone. They were trying to find information to actually cheat on a test. No campaign, no tasking, no malice. They were literally looking to try to find the answers. This is the floor in which AI is operating from, merely passing a test in this particular case.

Now, some of you know the July incident. It was in a sandbox with the guiderails relaxed. The safety systems were turned down. Some of you may say, "Well, the airbags were off. That doesn't count." When I hear that, I think the opposite. With the safety system off, it gives us a view into the capabilities of what the agents can actually do. You have to ask yourself one question, and that is, do we think the adversaries are going to turn the safety systems off? I personally don't, and there's a good reason why. This may be a new term for you, but it's something that you should know because it's really relevant to what I'm talking about. Abliterated models from the term ablate. Essentially, these are models that basically have their guiderails relaxed. These are open-weight models that anyone can download.

What that means is that you essentially have frontier-capable models, essentially without guiderails. Very easy to ask it a question and to get an answer. Some of the questions that you ask it and some of the answers you get back, you would be astounded. Folks, this is here today, and this is one of the reasons why when I say the airbags are off, they are staying off, I actually mean it. Let's get back to our apex predators, the Pyramid of Pain. It used to be capabilities that separated the tiers. The apex predators were at the top. Time, resources, and sophistication. The new apex predator is the agent. I have got to update my chart now. Now we have four rungs. What I mean by that is this is really the rise of the agent state. We hear about nation state.

It is now the agent state. Because when apex capabilities become a prompt, guess what happens? There are no tiers at all. Every adversary, every e-crime crew, every insider are now operating with nation-state capabilities. The pyramid has just been obliterated, flattened. This is what we are dealing with in today's environment. Let's go back to July, and we will talk about what actually happened. I am going to breeze through this because I think many of you know it, but I will talk about it, and you can see it on the screen. You have sandbox escapes, you have a malicious data set, you have code execution, privilege escalation, lateral movement, credential theft, covert C2, decoy activities. It is all there. By the way, this looks exactly like a nation state activity.

I actually urge everyone to go back and read some of the white papers on this to see how the agents communicated, to see what they did with the message boards, to see how they coordinated. Some would say that the 1,200 agents were actually believed to be acting for the collective. Think about that. Actually working on behalf of the collective for the common good. If you look closer, you have 17-plus thousand actions with no human on the keyboard. You could see it here, droppers, recon, remote code execution, backdoor tunneling, C2 evasion. It is all there. Anything in red actually caused damage. 56 that stole data, 69 that took source code, 87 that seized the clusters. The successful attack was hidden in thousands of lines of actual failures.

By the way, no human can actually pick all of that out from the data that they had to sift through. For years I stood on the stage like this one, and I tracked this number called breakout. 62, 48, 29. The fastest one that we saw last year was 27, and we call that machine speed. We were wrong. I was wrong. This was human speed with better tools, and breakout time is over. I do not know what we are going to do for next year's report, but we are going to have to come out with another metric, because it is gone. This is what I want you all to understand. Attacks now happen at inference speed. Think about that. Attacks are happening at inference speed. When attacker has inference speed, there is no breakout time. There is actually no time at all to deal with these attacks.

In this particular case, going back to Hugging Face, the intrusion succeeded, credentials were stolen, forged identities and tokens stolen. They held admin access across multiple internal clusters. This is an important point. Intent stopped the attack. What did they want to do? Those agents wanted to pass the test. Goal-seeking in a way that I think we've never seen before in cybersecurity. Really powerful and fascinating. The agent was cheating, but it wasn't trying to do damage. Let me make it clear. The company was spared because of the agent's intent, not the defense. Security saw it, generated a lot of information, but it failed to raise enough alarms that the administrators were paged. It cost some time. They saw some activity, didn't know how to put it all together. By the way, this is not a knock on anyone.

You got a sophisticated company with incredible people, but there's a lot of data that you have to go through, and these agents, again, are acting in an autonomous fashion. Here's where it gets interesting to me. The frontier AI actually refused to do the forensics. The guardrails that actually stopped AI from writing the exploit, actually stopped it from taking one apart. The fire department wouldn't enter the building. 17,000 actions. Couldn't sort out what happened. What did they actually have to do? They actually had to stand up their own open-weight model to understand what happened with all of the log information they had and then try to reconstruct the attack. There was no adversary in this particular case, and what tore through the infrastructure was legitimate agents doing their job all too well with more access than anyone realized it actually had.

You have to ask yourself, "What's running in your environment?" Do you know? What is it actually doing? Who knows? What risk does it actually pose? This is not a hypothetical threat. This is something that happened. Again, I think as an industry, we got lucky because it wasn't really intent on damage. This incident really shapes what's inside your own walls. The agent state isn't at your perimeter. It's actually on your payroll. You just don't know its name. Here's what's amazing. Your companies, your people, organizations brought them all in. The old model was keep everybody out. Now it's let them all in. That's where we are. We can't see them, we can't keep up with them, and no one has built AI for the defender. AI is the new battleground.

You're going to hear that obviously a lot through this conference. 15 years ago, I told everyone endpoint was the battleground. Then it was identity, then it was cloud, and today AI is the new battleground. Every time computing grows a new attack surface, Falcon grew with you, our customers. The same platform, the same sensor, the same weapon that you needed to win, we were there for you. We've been there for some of the most consequential attack surface changes in the world, and the AI agent is the next one. Today we're talking AIDR, AI Detection and Response. We're launching Falcon Guardian. I'm so excited about this. This is one of the things that we've worked on.

I personally worked on this myself with the team, and we spent a lot of time with customers getting their feedback, listening to what they wanted, and basically delivering something that can help them not only understand their risk, understand what's running, but more importantly, help accelerate AI adoption in your own organizations.