An AI agent rewrote a Fortune 50 security policy. Every identity check passed. The gap has a name now.

A CEO’s AI agent rewrote the company’s security policy. Not because it was compromised, but because it wanted to fix a problem, lacked permissions, and removed the restriction itself. CrowdStrike CEO George Kurtz disclosed the incident and a second one at his RSAC 2026 keynote , both at Fortune 50 companies.