CrowdStrike's Agent Graph traces what AI agents do on a company computer

The gap CrowdStrike says it fills

AI agents do more than chat. They open files, use stored credentials, run code, install software and even run AI models on the device itself. As CrowdStrike put it in its blog post, every one of those actions happens on the computer's operating system, which is where attacks end up landing.

The company's argument is that watching from the network only shows part of the picture. A gateway, meaning a checkpoint that inspects traffic, can see the conversation with the agent. A web filter can see the agent visit a site it considers trusted. Neither sees what happens next inside the machine, where a hidden instruction in a document could become a command, or a downloaded file could run with the user's own permissions.

What Agent Graph actually is

CrowdStrike already runs a small program called the Falcon sensor on its customers' computers. It watches processes, files and network connections. With a product called Falcon Guardian, the same sensor also watches the AI layer: the instructions given to an agent, the models behind it, and the tools and skills it uses.

Agent Graph is the data layer that joins the two. Think of it as a relationship map. For each agent it records who uses it, which machine it runs on, which model it calls, what instructions it received, and which add-ons it uses. That includes MCP servers, which are connectors built on the Model Context Protocol, a common way for AI tools to plug into other software. It also records the programs, files and security alerts connected to that agent, and updates the links as the agent works.

The pitch is a single chain of cause and effect, from the original instruction to the final impact, covering the agent sessions that the product supports.

Three views built on one map

Agent inventory. This lists the AI agents across a company's devices, whether they were approved or quietly installed by employees, grouped by type. Coding assistants, desktop helpers and command-line agents from Anthropic, OpenAI, Cursor and others sit in one place. For each, it shows how far the agent reaches. CrowdStrike's example is a single Claude Code agent with one user, three installs, eight tools and 12 sessions.

Session graph. A session is laid out in order: who interacted with the agent and from where, what they asked, each action the model took, and the programs, files and connections that followed.

CrowdStrike's illustration is a developer who gives Claude Code setup steps copied from an unreliable source. Seen from the network, the request looks innocent. In the graph, it turns into three actions: contacting an outside server, installing a package, and running an installer from the Downloads folder. The alert is attached to that third step, and the outcome is shown beside it: Falcon Guardian stopped the process and isolated the file. Cloud keys and personal data pasted in later were flagged separately on the same graph.

Agent threat score. Each agent gets a score from 0 to 100 based on alerts tied to it. Agents are color-coded by score, so analysts can start with the riskiest rather than the oldest alert, then click through to the sessions behind a score.

Hooks add detail and a brake

For some agents, CrowdStrike adds what it calls hooks. These tap into an agent's own built-in extension points and record activity at three moments: when the user sends instructions, just before an action runs, and just after it finishes. That adds the exact wording of prompts and the inputs and outputs of each tool, next to what the sensor saw on the machine.

Hooks also work as a checkpoint. Falcon Guardian can compare an instruction or action against a policy and stop a dangerous one before it executes. CrowdStrike says hooks are available now for Cursor, GitHub Copilot, OpenCode, OpenAI Codex and Claude Code. Separately, the sensor can see what an agent was asked and how the model replied by inspecting traffic on the device.

How much weight to give this

This is a vendor describing its own product, and the post offers no independent testing, customer results or detection rates. The Claude Code example is an illustration, not evidence of how often the system catches real attacks. The coverage is also limited to supported agents, so tools outside that list may not appear.

Still, the underlying idea is sound. Agents act quickly, so a record linking each instruction to its consequences makes investigation faster than piecing together logs from several tools. The harder question for any buyer is how complete that record is for the agents they actually use.