CrowdStrike, Cisco, Microsoft, and Google Expand AI Cyber Defense

SAN RAMON & BARCELONA — Enterprise cybersecurity providers and threat intelligence teams announced major AI governance platforms and infrastructure takedowns on Tuesday, November 3, as CrowdStrike, Cisco, and Microsoft introduced new runtime controls for autonomous agents while Google and Microsoft Threat Intelligence detailed large-scale cloud LLMjacking and proxyware campaigns.

CrowdStrike Acquires Fiddler AI and Dreadnode; Cisco and Microsoft Expand Agent Governance

At its Fal.Con Europe conference in Barcelona, CyberScoop reported that CrowdStrike signed agreements to acquire 2 artificial intelligence security companies—Fiddler AI (reported by the Wall Street Journal at $400 million) and Dreadnode (reported at $95 million)—with both cash-and-stock transactions expected to close and reach general availability in CrowdStrike’s fourth quarter (Q4) of fiscal 2027:

• Fiddler AI (Falcon Observe) & Dreadnode: Fiddler AI traces agent reasoning across frameworks including LangGraph, Amazon Bedrock, and Google ADK, which CrowdStrike CEO and founder George Kurtz called "the flight recorder for every agent." Dreadnode, led by CEO Brad Palm, runs more than 100 attack methods—including jailbreaks and prompt injection—mapped to the OWASP Top 10 for large language models and the NIST AI Risk Management Framework. Alongside Falcon Guardian, Kurtz unveiled a runtime AI Kill Switch that operates outside the model so human operators can halt any autonomous agent immediately.
• Cisco Defends at Machine Speed with OpenAI: According to OpenAI News, Cisco President and Chief Product Officer Jeetu Patel detailed how Cisco combines network telemetry across microservices, Kubernetes containers, and clusters with OpenAI’s GPT-6 Astra and the Daybreak Defense Network inside Cisco Cloud Control—operating under zero data retention and strict isolation boundaries—to correlate signals at machine scale and narrow the gap between vulnerability exploitation and patching.
• Microsoft Agent 365 Named Gartner Leader: In a post by Nadim Abdo and Ray Smith, the Microsoft Security Blog announced that Microsoft was named a Leader in the inaugural 2026 Gartner Magic Quadrant for AI Agent Management Platforms (published October 27, 2026). More than 50 million agents have been registered in Microsoft Agent 365, which assigns each agent a Microsoft Entra Agent ID across Microsoft Entra, Defender, Purview, and Intune, integrates with Agentforce, Amazon Bedrock, Anthropic, Databricks, Google Gemini, and Google Vertex, and is expanding discovery by 35 additional local agent types to 60 total alongside the new Agent 365 Action Center.

Google GTIG and Mandiant Warn of $1 Million Cloud LLMjacking Attacks

Researchers at Google’s Threat Intelligence Group (GTIG) and Mandiant warned via BleepingComputer that 2 coordinated threat clusters are hijacking enterprise cloud AI accounts (LLMjacking), driving request spikes above 1,000 requests per second and generating fraudulent token charges exceeding $100,000 in a single day and reaching $1 million ($1,000,000) cumulatively at victim organizations.

Attackers steal cloud credentials, GitHub tokens, or API keys—or exploit CVE-2026-40217, an arbitrary code execution flaw in LiteLLM’s custom-code guardrail testing endpoint—and resell access to proxy services known as LLM mixers. One service, Jet Night (jet-night.com), sells unlimited access plans for $60/month and executed more than 500,000 LLM API calls in under 8 hours, passing nearly $1 million in token costs to a single victim organization. Google also tracked threat cluster UNC6993 and a persona dubbed D1337-KAIROS, urging enterprises to enforce least-privilege Identity and Access Management (IAM), phishing-resistant multi-factor authentication (MFA), and strict API spending caps.

Google Dismantles 1.3M-Device X.CPE Botnet; Microsoft Exposes Trojanized Inno Setup Campaign

Two major endpoint and IoT monetization operations were also disrupted or exposed on Tuesday:

• X.CPE Android TV Botnet Dismantled: As reported by The Record, Google, Japanese law enforcement, and cybersecurity firms TrendAI (where Robert McArdle serves as director of cybercrime research), Human, and Synthient dismantled the X.CPE botnet, which infected more than 1.3 million Android TV set-top boxes, telehealth devices, karaoke machines, and digital signs across more than 200 countries. Google attributed the firmware-embedded backdoor—updated in 2024 and 2026—to Chinese original equipment manufacturer Videostrong Technology (which has operated for more than 14 years), banned Videostrong from Android certification, and used court orders to sever command-and-control domains, which Charley Snyder of Google Threat Intelligence Group said cut off cybercriminal access to an additional 10 million compromised devices.
• Microsoft Threat Intelligence Inno Setup Alert: In a technical report by Jiacen Xu, the Microsoft Security Blog detailed a 4-stage fake-download campaign using trojanized Inno Setup installers (d=inno, r=offer_execution) disguised as cracked software and game utilities (such as Echo Client, FabFilter Total Bundle, and Navicat Premium) to silently deploy 3 monetization branches: WorldProxyPool proxyware (creating SYSTEM scheduled tasks including a 5-minute PowerShell watchdog and hourly updater), CharityEngine and BOINC distributed computing (bundling VirtualBox 7.2.8), and Advanced Windows Manager / Windows Manager adware.