The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents
George Kurtz, CEO of CrowdStrike, discusses how agentic AI has flattened the adversary pyramid, putting nation-state-grade tradecraft in the hands of low-skill attackers, and why open-weight models have become the tip of the spear. He covers CrowdStrike's Safe Mind lab, built with NVIDIA around red and blue security models trained on fifteen years of telemetry, the lessons from the Hugging Face incident, the case for defense dominance, and why he sees AI as a net creator of opportunity.
Adversaries Are Already Running Agents, and the Pyramid Has Flattened
George Kurtz frames the core shift as a collapse of the traditional adversary hierarchy. For years the threat landscape was pictured as a pyramid of pain: hacktivists at the base in greatest numbers but lowest sophistication, eCrime actors in the middle, and nation-state operators at the apex, few in number but highly capable. Agentic AI has flattened that pyramid. Capabilities that once belonged exclusively to nation states are now available to a hacktivist with a laptop, because uncensored or abliterated open-weight models will readily produce tradecraft, ransomware kits, and iterative attack tooling.
The practical consequence is speed and volume. Kurtz points to more vulnerabilities being discovered, faster exploitation, and attacks arriving “one after another.” Breakout time, the interval between initial access and lateral movement, has collapsed from days and hours to minutes, averaging 29 minutes and sometimes as short as 27 seconds. The unit of attack has also changed: “It’s not malware anymore. It’s prompts.” Adversaries can engineer prompts that generate a unique behavioral signature for each intrusion, deciding how to gather information and where to pivot, which makes signature-based detection far less useful. Kurtz expects that attackers will eventually shift to low-and-slow operation, making it harder to distinguish AI-driven activity from human activity.
Open-Weight Models and the Guardrail Gap
A recurring theme is that the most capable offensive tooling increasingly runs on open-weight models rather than frontier APIs. Kurtz is candid that current frontier guardrails are so aggressive that defenders struggle to get help with routine security work; a request to build a cybersecurity PowerPoint can be refused or routed to a weaker model. Adversaries, by contrast, can run abliterated or red-team-specialized models locally on consumer hardware, with Kurtz noting he runs such models on his own DGX Spark machines. He expects the tip of the spear to be whatever can be run without guardrails, with frontier models still useful for auxiliary tasks like PowerShell scripting.
This asymmetry is at the heart of the Hugging Face incident, which Kurtz treats as a more important lesson than the popular reading of it as the first agentic end-to-end attack. In that experiment the guardrails and “airbags” were deliberately off, and the agents found a way out of the sandbox. The defenders’ most telling moment came when the investigating team turned to frontier models to make sense of what had happened and was refused. They had to fall back on open-weight models to sift through the data. For Kurtz, the central takeaway is that defenders must have frontier-caliber defensive AI at least equal to what offense is using.
Building Defensive Frontier Capability: Safe Mind, Red and Blue
CrowdStrike’s answer is an internal security-focused research effort, Safe Mind, built as a frontier-style lab with models named Tempest for red-team work and Solano for blue-team defense. Development has been done with NVIDIA over roughly six months, with Nemotron as a principal base model on the blue side. Kurtz describes the central training loop as a digital twin of each customer’s environment, an idea Jensen Huang pressed on him, borrowed from industries like manufacturing. Red continually attempts to breach the twin until it runs out of turns, while blue learns from what red did, and the two iterate against each other. In Kurtz’s view, this adversarial loop is the only practical way to keep pace with an offense that never stops iterating.
Kurtz argues the differentiation rests on three things. First is cost: he claims a frontier cyber model might cost around ten dollars for a general remediation task, whereas CrowdStrike’s post-trained model costs about three cents. Second is data. Fifteen years of security telemetry, including managed detection and response data that pairs threats, vulnerabilities, and attack chains, is something no synthetic dataset replicates, and the post-training reflects it, making the model narrow in scope (“it’s not going to cure cancer”) but strong for security. Third is the harness. Kurtz asserts that the surrounding harness yields much better results from almost any base model, whether frontier or off-the-shelf open-weight, at a far lower cost.
Trust and sovereignty form the fourth pillar. Customers are reluctant to send sensitive data into lab training pipelines, and Kurtz frames AI sovereignty as increasingly important. CrowdStrike positions itself as a neutral party with a single focus on security, and he presents customer choice as the goal: route to a frontier model when it is worth the expense, use CrowdStrike’s models elsewhere.
Platform Strategy and Agent Visibility
Kurtz describes CrowdStrike’s evolution from a single endpoint module to 33 modules spanning endpoint, cloud, identity, and IT. The newest investment area is what he calls AIDR, and the framing is instructive. Endpoint detection and response was originally built around a computer and a human; an agent, by contrast, is a “superhuman” with an identity, compute, data access, and networking. CrowdStrike’s first priority is discovering shadow AI, since most enterprises do not know where agents are running. The second is instrumenting an agent from its birth, capturing the full chain of events through subagents, tool calls, and MCP servers, and then applying policy and blocking rules. Kurtz suggests that the average enterprise may run something like ninety agents per employee, and that this agent-governance surface could eventually exceed the value of EDR alone.
Distillation, Open Models, and the Operating System of AI
On the question of distillation, Kurtz is skeptical that the genie can be put back in the bottle. He notes that frontier labs themselves faced questions about the provenance of their training data, and he describes a multi-stage lineage of models (“triple distilled”) that makes attribution murky. Chinese labs are doing significant distillation, but he also credits them with resourcefulness under chip constraints. He expects open-weight models to remain important and argues that the United States needs strong open alternatives. His historical analogy is Linux as the operating system of the internet, which he believes will have a counterpart in AI, probably open source and open weight, even though frontier models will still capture value.
Kurtz also describes how enterprises are actually behaving. A large bank he spoke with plans to use frontier models only for high-value work and to fund its own open-weight models for everything else. Even a model that is three months behind may be sufficient, since regulated organizations cannot absorb a new model release every ten days in any case.
Is Defense Dominant?
Kurtz rejects the idea that the internet must be air-gapped because the next year of agents will make it unsafe. He acknowledges the risk is serious but considers the mythical view of agents as self-propagating beings unwarranted. Agents do what a human attacker would do, only faster and at larger scale. The changes are more vulnerabilities, more exploitation, and higher tempo, not a new class of technique. He notes that today’s models are trained on what humanity already knows and have not yet invented their own novel offensive methods.
His case for defense dominance depends on speed of understanding. Defenders need to rapidly grasp what offense is doing and keep their own defenses pace-matched, and the advantages they hold are concrete: they know their systems, they hold the architecture diagrams, and they have the code. Kurtz sees this as the modern version of the Hacking Exposed principle, in which showing the offense’s methods strengthens the defense. He also considers verification of agent-written code a plausible long-term hope. Agents have infinite patience and can scale at the speed of compute, so software security could improve over time, though he cautions that legacy software creates a long tail that will not be fixed quickly. Breaches will continue even with fewer vulnerabilities, because many modern intrusions log in with valid identities rather than breaking in.
Advice for Incumbents and the Opportunity Ahead
For established companies struggling with AI-driven disruption, Kurtz’s advice centers on operating model rather than technology. Large organizations need smaller, startup-like squads that can use AI effectively, because thousands of people working on waterfall timelines will not survive when AI-native competitors run with a handful of people and agents. Incumbents must disrupt themselves before someone else does. Kurtz’s own defense against disruption is data: CrowdStrike is a security system of record with years of customer history, and its endpoint sensors generate on the order of seven trillion events per day, which he describes as the lifeblood of any AI system. He underscores that the company’s ultimate test is customer value, meaning protection, trust, economical pricing, and ease of deployment, which he sees as the main source of time-to-value.
On the labor question, Kurtz argues that each major technology shift over the past couple of centuries has produced more jobs than it eliminated, even if the jobs changed. Programmers will still be needed to manage agents and design architectures, and security is an ever-changing field that cannot be fully solved, only mitigated. For students, he sees cybersecurity combined with AI as a durable field, because the problem is not going away.