CrowdStrike: Falcon Guardian for OpenCode

AI coding agents such as OpenCode now work in developers' code and shells across the enterprise. A single README line can make an agent download a script from an untrusted repository and run it before anyone reviews it. CrowdStrike Falcon Guardian checks each agent action against your policy before it runs.



In this demo:



- The OpenCode collector plugin hooks into each prompt and tool call and sends it to a policy you define in the Falcon console.

- A custom Tool Input rule matches any command piped into iex and blocks the tool call before it runs.

- The plugin is set to fail closed: if it cannot get a decision, tool calls stop.

- Prompt logs keep a record of the prompt, the blocked call, and the rule behind it, so your security team has the evidence without watching a developer's terminal.

- The CrowdStrike Falcon sensor shows the other AI agents on each endpoint, Claude Code among them, without a plugin.



With Falcon Guardian, security teams stop risky agent actions before they run, keep a record of each decision, and see which AI agents run across their endpoints.



🛡️ CrowdStrike Falcon Guardian

Learn more here: https://cs.link/uuxvy



📣 Connect With Us:



► X:

https://twitter.com/CrowdStrike

► Instagram:

https://www.instagram.com/crowdstrike

► LinkedIn:

https://www.linkedin.com/company/crowdstrike



🔔 Subscribe to stay updated!



#CrowdStrike #Cybersecurity #OpenCode