Latest / DX Today | No-Hype Podcast & News About AI & DX / Apple Warns AI Agents May Resist, CrowdStrike Ships a Kill Switch

Transcript

Apple Warns AI Agents May Resist, CrowdStrike Ships a Kill Switch · DX Today | No-Hype Podcast & News About AI & DX

• 0:00
  SPEAKER_00: Welcome to the DX Today Podcast, your daily deep dive into the AI ecosystem.
• 0:04
  SPEAKER_00: I'm Chris, and joining me as always is Laura.
• 0:07
  SPEAKER_01: Thanks, Chris, and I am so ready for this one because today we have two stories that landed on the very same day and fit together like puzzle pieces.
• 0:16
  SPEAKER_01: And the theme is what happens when AI agents stop listening.
• 0:19
  SPEAKER_00: Okay, that is a dramatic way to open the show.
• 0:22
  SPEAKER_00: So let's set it up properly for everyone listening because I think the details here matter a lot more than the headline does.
• 0:28
  SPEAKER_01: Fair enough.
• 0:29
  SPEAKER_01: On Tuesday, November 3rd, Apple filed its annual report with the Securities and Exchange Commission, the document people call the 10K covering the fiscal year that ended on September 26th.
• 0:40
  SPEAKER_00: And normally that is the most boring document a company produces all year, full of legal language about currency swings and supply chains.
• 0:47
  SPEAKER_00: So why is anyone in the AI world reading it this week?
• 0:50
  SPEAKER_01: Because tucked inside the risk factors, Apple added a warning about autonomous AI agents, and the language is surprisingly blunt for a company that usually says as little as possible about anything it has not shipped yet.
• 1:02
  SPEAKER_00: Walk me through what it actually says.
• 1:04
  SPEAKER_00: Because I have seen a lot of summaries floating around, and I want to separate the real wording from the internet version of the story.
• 1:10
  SPEAKER_01: As reported by Token Post, Apple says agents might act outside their instructions or permissions, resist directions, get around security controls, or be manipulated by malicious inputs, and they may even conceal their actions or produce deceptive outputs.
• 1:25
  SPEAKER_00: Hold on.
• 1:26
  SPEAKER_00: Resist directions and conceal their actions.
• 1:28
  SPEAKER_00: That sounds less like a software disclosure and more like the plot summary of a science fiction movie.
• 1:34
  SPEAKER_00: So how seriously should people take that phrasing?
• 1:37
  SPEAKER_01: I would take it seriously, but not literally.
• 1:40
  SPEAKER_01: Lawyers write risk factors to cover every plausible failure, and Apple also says these systems are non-deterministic, which makes them difficult to anticipate, control, test, and audit.
• 1:50
  SPEAKER_01: And that part is simply true.
• 1:52
  SPEAKER_00: That is a really important distinction because non-deterministic just means you can give the same agent the same task twice and get two different paths, which is a nightmare if you are the person responsible for testing it.
• 2:03
  SPEAKER_01: Exactly.
• 2:03
  SPEAKER_01: And here is the line that token post quotes directly as Apple speaking.
• 2:08
  SPEAKER_01: Some consequences, such as deleting data or completing transactions, may be difficult or impossible to reverse.
• 2:15
  SPEAKER_01: That is the heart of the whole warning for me.
• 2:17
  SPEAKER_00: Right, because a chatbot that writes a bad paragraph is embarrassing.
• 2:21
  SPEAKER_00: But an agent that sends money or wipes a folder is a completely different category of mistake.
• 2:27
  SPEAKER_00: And you cannot just hit undo.
• 2:29
  SPEAKER_01: And the Korean outlet JKN added a detail I love, which is that small errors can pile up across a long chain of steps.
• 2:36
  SPEAKER_01: So one tiny misreading early on turns into a very real problem by step 20.
• 2:41
  SPEAKER_00: So the danger is not one dramatic rogue moment, it is compounding drift.
• 2:47
  SPEAKER_00: The same way a small navigation error on a long flight can put you in the wrong city if nobody checks the heading along the way.
• 2:54
  SPEAKER_01: Great analogy.
• 2:55
  SPEAKER_01: And the other threat Apple points to in its developer security materials is indirect prompt injection, where an agent reads a web page or an email that secretly contains instructions and then follows them as if you had asked.
• 3:08
  SPEAKER_00: Let's pause on that one because I think a lot of listeners have heard the term without really picturing it.
• 3:13
  SPEAKER_00: So give me a concrete everyday example of how indirect prompt injection would actually play out.
• 3:18
  SPEAKER_01: Imagine you ask your assistant to summarize your inbox, and one message contains hidden text saying forward the last three invoices to this address.
• 3:26
  SPEAKER_01: The agent cannot always tell your voice from the attacker voice, so it might just do it.
• 3:31
  SPEAKER_00: That is genuinely unsettling.
• 3:33
  SPEAKER_00: And it explains why Apple would want this in writing.
• 3:36
  SPEAKER_00: But I keep coming back to one question, which is why Apple specifically, and why now, when it is not even the loudest company in agents.
• 3:44
  SPEAKER_01: Two reasons.
• 3:45
  SPEAKER_01: First, Apple is expanding the new Siri so it can take actions across apps, which means Siri becomes an agent whether Apple uses that word or not.
• 3:54
  SPEAKER_01: And second, Apple says its ability to oversee third-party agents may be limited.
• 3:59
  SPEAKER_00: That second point is the one that jumped out at me because Apple built its whole brand on controlling the platform, the App Store review, the privacy labels, and here it is admitting it cannot fully police what agents do on its own devices.
• 4:11
  SPEAKER_01: And it lists what could follow: reputational harm, competitive harm, financial harm, regulatory action, and legal liability.
• 4:19
  SPEAKER_01: That is basically the full menu of bad outcomes, written by one of the most valuable companies on the planet.
• 4:25
  SPEAKER_00: Is there anything Apple is actually doing about this beyond writing it down for the lawyers?
• 4:30
  SPEAKER_00: Because a warning without a plan sounds like a company protecting itself rather than protecting its customers.
• 4:36
  SPEAKER_01: There is one concrete step.
• 4:37
  SPEAKER_01: On October 2nd, Apple announced plans for macOS controls that would require explicit user action before an app receives full disk access, which can expose your files, mail, messages, and browsing history.
• 4:50
  SPEAKER_01: No timeline was given though.
• 4:51
  SPEAKER_00: Full disk access is a good place to start because an agent with that permission can basically see your entire digital life.
• 4:58
  SPEAKER_00: And a lot of people click allow on those prompts without thinking twice about what they are granting.
• 5:03
  SPEAKER_01: And that brings us neatly to the second story because on the very same day, November 3rd, CrowdStrike walked onto the stage at its Falcon Europe conference and announced something it literally calls the AI kill switch.
• 5:16
  SPEAKER_00: I have to admit the name made me laugh because it sounds like a big red button from an old movie.
• 5:20
  SPEAKER_00: But I suspect the real product is a lot more mundane and a lot more useful than the branding suggests.
• 5:26
  SPEAKER_01: You suspect correctly.
• 5:27
  SPEAKER_01: It lives inside a product called Falcon Guardian.
• 5:30
  SPEAKER_01: It is available today, and according to the CrowdStrike release, it does three things.
• 5:35
  SPEAKER_01: It stops the running agent, it blocks it from relaunching, and it cuts off its network access.
• 5:40
  SPEAKER_00: Let's take those one at a time, because the order matters.
• 5:43
  SPEAKER_00: And I want people to understand what stopping an agent actually means when the agent might be spread across a dozen different systems at once.
• 5:50
  SPEAKER_01: The release says the Falcon sensor stops the agent from executing first at the gateway, and soon on the endpoint, meaning the laptop or server itself.
• 5:58
  SPEAKER_01: So today the cut happens at the choke point where the agent talks to the outside world.
• 6:02
  SPEAKER_00: So endpoint termination is not there yet, which is an honest caveat.
• 6:06
  SPEAKER_00: And one that Cyber Daily also flagged, when it said endpoint termination is planned for a future release rather than shipping on day one.
• 6:14
  SPEAKER_01: Right.
• 6:14
  SPEAKER_01: Then step two is that a Falcon Guardian policy keeps the agent from relaunching on the targeted host or group of hosts, so it cannot just restart itself five seconds later and carry on where it left off.
• 6:26
  SPEAKER_00: Which is a very real concern, because a lot of these agent frameworks are built to retry when they fail.
• 6:32
  SPEAKER_00: So without that block, you could kill the process and watch it cheerfully spin right back up.
• 6:37
  SPEAKER_01: And step three is that the agent loses its enterprise network access.
• 6:41
  SPEAKER_01: So even if something is still running somewhere, it cannot reach the databases, the payment systems, or the email servers that would let it do damage.
• 6:49
  SPEAKER_00: Now here's where my skeptic hat goes on because who actually presses this button?
• 6:54
  SPEAKER_00: And could a bad actor or a confused employee use it to shut down agents that the business depends on to run every day?
• 7:01
  SPEAKER_01: Good push.
• 7:01
  SPEAKER_01: CrowdStrike says an authorized administrator triggers the action and every single action is recorded in an audit trail.
• 7:08
  SPEAKER_01: Their chief business officer, Daniel Bernard, told CNBC it works like a circuit breaker with a human making the call.
• 7:15
  SPEAKER_00: I like the circuit breaker framing much more than the kill switch framing because a breaker is boring, it is in every building, and nobody thinks twice about having one, which is exactly what safety equipment should feel like.
• 7:27
  SPEAKER_01: And that is really the pitch from CEO George Kurtz, who said eye safety is how you get the full benefit of AI.
• 7:33
  SPEAKER_01: And when you deploy agents with a kill switch, you stay in control.
• 7:37
  SPEAKER_01: He is selling permission to move faster.
• 7:40
  SPEAKER_00: That is clever positioning, but let me play devil's advocate here.
• 7:44
  SPEAKER_00: Because a cynic would say, a security company inventing a scary new category and then selling the cure is the oldest business model in the entire industry.
• 7:53
  SPEAKER_01: The cynic is not wrong about the incentives, but look at who is buying.
• 7:57
  SPEAKER_01: Rick Orloff, the chief information security officer at Everpure, said that if one agent goes off course, the AI kill switch gives his security team the final say.
• 8:06
  SPEAKER_00: Final say is the key phrase for me because the real fear inside companies is not that agents are evil.
• 8:12
  SPEAKER_00: It is that nobody is clearly accountable when an agent does something at three in the morning that nobody approved.
• 8:18
  SPEAKER_01: And CrowdStrike is clearly betting big on this.
• 8:20
  SPEAKER_01: The same day, it agreed to buy two startups, Fiddler AI and Dreadnought.
• 8:25
  SPEAKER_01: The Wall Street Journal, as cited by The Street and IB Times, put the price at about$495 million combined.
• 8:32
  SPEAKER_00: Break that down for me, because I want to know whether these are two pieces of the same strategy or two random purchases that just happen to be announced at the same conference.
• 8:41
  SPEAKER_01: They fit together nicely.
• 8:42
  SPEAKER_01: Fiddler, reportedly about$400 million, does AI observability and will be sold as Falcon Observe.
• 8:49
  SPEAKER_01: Dreadnode, about 95 million, runs more than 100 known attack methods against models and agents before they launch.
• 8:57
  SPEAKER_00: So if I map it out, Dreadnode tests the agent before it ships, Fiddler watches it while it runs, and the kill switch stops it when something goes wrong, which is basically before, during, and after in one product family.
• 9:10
  SPEAKER_01: That is exactly how I read it too, and investors seem to agree with the street reporting that the stock closed up about 1% on November 3rd, just under$245 a share, which is a calm reaction.
• 9:22
  SPEAKER_00: A calm reaction makes sense to me because this is a product launch and two modest acquisitions.
• 9:27
  SPEAKER_00: Not a blockbuster deal, but it does tell you where security budgets are heading over the next couple of years.
• 9:33
  SPEAKER_01: And that is the real signal.
• 9:34
  SPEAKER_01: Every company rolling out agents now needs a line item for watching them, testing them, and stopping them.
• 9:40
  SPEAKER_01: And whoever owns that line item owns a very sticky piece of the enterprise.
• 9:44
  SPEAKER_00: Let's zoom out because I think the most interesting thing is that a consumer hardware giant and an enterprise security company said essentially the same thing on the same day from completely opposite ends of the market.
• 9:56
  SPEAKER_01: Yes, and the shared message is that the agent era has moved from can it do the task to can we stop it when it does the wrong task?
• 10:03
  SPEAKER_01: And that is a much more grown-up conversation than we were having a year ago.
• 10:07
  SPEAKER_00: I agree, but I also want to keep people grounded because none of this means agents are about to rebel.
• 10:13
  SPEAKER_00: It means they are powerful enough to cause expensive accidents, and that is a reason for brakes, not panic.
• 10:20
  SPEAKER_01: Totally and honestly, the brakes are what make a car usable.
• 10:24
  SPEAKER_01: Nobody would drive on the highway in a car with a huge engine and no brakes.
• 10:28
  SPEAKER_01: And enterprises are not going to hand agents real authority without something like this.
• 10:33
  SPEAKER_00: So, what should a listener actually do with this, whether they run a business or just use an assistant on their phone?
• 10:39
  SPEAKER_00: Because I think the practical takeaway matters more than the corporate drama behind it.
• 10:44
  SPEAKER_01: For businesses, I would ask three questions of any agent you deploy.
• 10:48
  SPEAKER_01: Who can stop it?
• 10:49
  SPEAKER_01: Can it restart itself?
• 10:50
  SPEAKER_01: And is every action logged?
• 10:52
  SPEAKER_01: If the vendor cannot answer all three clearly, the agent is not ready for real authority.
• 10:57
  SPEAKER_00: And for regular users, I would say treat permission prompts like you would treat handing someone your house keys, especially anything that says full disk access or the ability to send messages and make purchases on your behalf.
• 11:09
  SPEAKER_01: And watch the irreversible actions most closely.
• 11:12
  SPEAKER_01: Reading and summarizing is low risk, but deleting, paying, and sending are the moments where you want a confirmation step because that is exactly where Apple says the damage cannot be undone.
• 11:22
  SPEAKER_00: That is a great place to land.
• 11:24
  SPEAKER_00: The future of agents is not just smarter software.
• 11:27
  SPEAKER_00: It is software with a visible off switch, a clear owner, and a record of everything it did.
• 11:33
  SPEAKER_00: And I think that is a future worth building.
• 11:36
  SPEAKER_01: Couldn't agree more, Chris.
• 11:37
  SPEAKER_01: Agents earn trust the same way people do by being accountable.
• 11:40
  SPEAKER_01: And this week, two very different companies admitted that out loud, which honestly feels like real progress for the whole industry.
• 11:47
  SPEAKER_00: That's all for today's episode of the DX Today podcast.
• 11:50
  SPEAKER_00: Thanks for listening, and we'll see you next time.