CrowdStrike Set Two AI Agents Loose on a Copy of Your Network. Neither One Is Supposed to Win.

Somewhere in CrowdStrike's cloud, a model called Red Tempest is working its way through a replica of a customer's network. A second model, Blue Solano, watches what it finds and closes the paths behind it. Then Red Tempest starts again, against the hardened copy. Neither agent is built to win. The fight itself is the product.

CrowdStrike unveiled that arrangement on September 1 at its Fal.Con conference in Las Vegas, under the name SafeMind: purpose-built security models plus what the company calls harnesses, the software that runs them against each other in a loop. It is the first release from CrowdStrike's Cyber Superintelligence Lab, announced the same day and headed by Dr. Bartley Richardson, who joined from NVIDIA.

Red Tempest is the offensive model, built to emulate adversaries in controlled red-team scenarios. Blue Solano is the defensive one, built to find gaps and generate protections. Both were post-trained on Falcon sensor telemetry, CrowdStrike threat intelligence, Falcon Complete managed-detection annotations, and fifteen years of incident-response fieldwork. The base models are NVIDIA Nemotron 3 open models; NVIDIA is the AI design partner, and CoreWeave supplies training and inference compute.

"The future of cybersecurity won't be defined by AI that simply identifies threats, it will be defined by AI that defeats them," said George Kurtz, CrowdStrike's chief executive and founder. "It finds weaknesses, strengthens protection, and gets smarter with every cycle."

Kurtz was blunter on stage about why CrowdStrike built its own models rather than renting frontier ones. Pointing to the recent Hugging Face breach, he argued most observers took the wrong lesson: "The real gap that I saw was that the attackers had frontier AI and the defenders didn't. That changes now." Hugging Face's responders had run into safety guardrails on commercial frontier APIs mid-incident and switched to open-weight models to finish the analysis.

The twin

The word doing the most work in the pitch is twin. SafeMind uses Falcon's sensor footprint to construct a digital twin of a customer environment, assembling asset inventories, identity stores, threat graphs and adversary intelligence into a working model of the network. Red Tempest traverses that copy looking for viable attack paths. Blue Solano learns of each path through the harness and builds a fix. The loop repeats. CrowdStrike describes the output as continuous red teaming at machine speed and the underlying dynamic as adversarial co-evolution.

NVIDIA is both partner and customer here. Jensen Huang, who shared the Fal.Con stage with Kurtz, said SafeMind had replicated NVIDIA's own IT estate using Falcon sensors already deployed across the company. "This is the beginning of a new age of cybersecurity," Huang said. "On the one hand, the adversaries are going to be more armed than ever. On the other hand, all of you are going to be more armed than ever."

CrowdStrike's internal evaluations, run against leading frontier models and open-source baselines, claim a 29 percent higher detection rate, six times faster end-to-end remediation, and 99 percent cost savings on detection and remediation. Those are the company's own figures. No independent benchmark has been published.

Two practical details went unmentioned in the keynote. CrowdStrike has not announced general availability or pricing. SafeMind will run natively inside the Falcon platform, with standalone access to the models and harnesses offered through Project QuiltWorks, the company's trusted-access partner program. That is a gating mechanism, not a ship date.

Why This Matters

Penetration testing has always been a photograph. A team arrives, spends two weeks, writes a report, and the environment changes the following Tuesday. An adversarial loop running continuously against a live model of the network is a genuinely different economic object: the cost of the thousandth test approaches zero, and findings arrive at the speed of the infrastructure rather than the speed of the consulting calendar. If it works as described, the number worth watching is not detection rate but how quickly a newly introduced misconfiguration gets found and closed.

That conditional rests almost entirely on fidelity. The twin is not the network. It is an inference about the network drawn from what Falcon sensors can see. Whatever sits outside that footprint, including unmanaged devices, contractor laptops, operational technology, authorization grants between SaaS applications and undocumented internal services, does not exist in the copy and cannot be probed inside it. Red Tempest exhausting every viable path in the twin establishes that the modeled subset is clean. That is not the same claim as the network being clean, and the space between those two statements is precisely where real incidents tend to live.

There is a second-order version of the same problem. Remediations validated in simulation are deployed into production, where the assumptions that made them safe in the twin may not hold. CrowdStrike, of all vendors, knows what a bad automated push costs.

Outside observers were enthusiastic but not uncritical. Dave Vellante, co-founder and chief analyst at theCUBE Research, called it the strongest Fal.Con keynote in his five years covering the event, while noting the asymmetry that automation does not erase. "It's not that the defense can't win," he said. "But that's an old saying: offense only has to win once." His colleague Krista Case described Kurtz's framing as a wake-up call for the industry while observing that attacks of the kind he described are not yet happening at scale. Reviewing the launch, the trade publication eSecurity Planet concluded that SafeMind's enterprise value would depend on access controls, deployment safeguards, false-positive rates and performance outside CrowdStrike's internal evaluations, which is a fair inventory of everything not yet on the record.

What to watch: a general-availability date and a price, which will say more about maturity than any keynote metric; any third-party evaluation of the two models; how CrowdStrike vets access to an offensive model distributed through a partner program; and whether the company publishes coverage statistics for the twin itself, meaning what fraction of a typical customer environment it reproduces. A vendor willing to tell you what its simulation cannot see is a vendor worth believing about what it can.