CrowdStrike Innovations Secure AI Agents and Govern Shadow AI

CrowdStrike is enhancing its Falcon platform with new capabilities focused on securing the rapidly expanding AI landscape. These innovations aim to address the increased attack surface created by AI tools, AI agents, and AI-powered software. The core issue highlighted is the vulnerability of the prompt and agentic interaction layer, which faces threats like indirect prompt injection and agentic tool chain attacks. The acceleration of shadow AI, where employees adopt AI tools without proper oversight, further exacerbates these risks. CrowdStrike's initiatives involve extending AI Detection and Response (AIDR) capabilities across endpoints, SaaS environments, and cloud environments to bridge the AI visibility and governance gap. These new features provide organizations with tools to secure AI development and adoption confidently.

Attack Chain

1. Initial Access: An employee installs a desktop AI application such as ChatGPT, Gemini, or Microsoft Copilot on their endpoint.
2. Agentic Action: The AI application is granted high system permissions, enabling it to execute terminal commands, browse the web, and interact with files.
3. Prompt Injection: An attacker injects malicious prompts into the AI application, exploiting its autonomy to perform unauthorized actions.
4. Data Exfiltration: The compromised AI agent accesses sensitive data and initiates exfiltration, potentially through a network connection.
5. Lateral Movement: The attacker leverages the compromised AI agent to discover other AI-related components on the endpoint, such as LLM runtimes or IDE extensions.
6. Privilege Escalation: The attacker uses discovered AI components to gain higher privileges within the system, potentially accessing critical assets.
7. Policy Violation: The AI agent violates content policies or access controls due to malicious prompts or compromised configurations.
8. Impact: Data leaks, unauthorized access to critical systems, and potential supply chain risks due to misconfigured AI tooling in the development environment.

Impact

The potential damage includes data leaks, unauthorized access to critical systems, and supply chain risks. By exploiting vulnerabilities in AI agents and shadow AI deployments, attackers can compromise sensitive data, disrupt operations, and gain a foothold for further malicious activities. The lack of visibility and governance around AI tools can lead to an expanding attack surface, making it difficult for security teams to detect and respond to threats effectively. The impact is broad, spanning from individual endpoints to SaaS and cloud environments.

Recommendation

• Enable container network interface monitoring on endpoints to gain visibility into desktop AI application telemetry, as outlined in the overview, to detect prompt attacks, data leaks, and policy violations.
• Utilize CrowdStrike Falcon Exposure Management with AI Discovery, referenced in the overview, to automatically identify and classify AI-related components running across endpoints in real-time.
• Implement Falcon AIDR policies, as seen in Figure 1, to monitor for prompt injection attacks, data leaks, and policy violations within Microsoft Copilot Studio agents.
• Deploy the Sigma rules provided below to detect suspicious network activity and process execution patterns associated with AI applications.
• Review and update access control policies for AI agents to minimize the potential blast radius of a compromise, as discussed in the Attack Chain.