Brex built a network watchdog for its AI agents because it assumed they were already compromised
Fintech company Brex couldn't get its security team to approve AI agents on its network, so it built its own open-source filter called CrabTrap that watches what agents send out rather than trying to control what they do.
Key points
- Brex released OpenClaw, an open-source AI coding agent, in January 2025, after coding models reached a new level of maturity in December 2024.
- Brex's security team initially rejected deploying AI agents internally because the agents could execute code freely on the corporate network.
- Brex built CrabTrap, an open-source network proxy, to monitor outbound traffic from AI agents rather than trying to restrict what the agents could do.
- Only about 2% of agent requests face a slow AI-based review; routine actions pass through instant pre-approved rules.
- Brex CEO Pedro Franceschi estimated a 70% chance the tool would be thrown away within six months, but said the experience gained was worth the investment.
Brex CEO Pedro Franceschi had a problem. His company had built an AI agent, a piece of software that can carry out multi-step tasks on its own, called OpenClaw. He wanted to put it to work inside Brex. His security team said no.
"Hell no. How could we trust an agent doing these things?" was how Franceschi described the reaction, speaking at VB Transform 2026 and first reported by VentureBeat. The concern was real: OpenClaw could write and run its own code, which meant it could, in theory, do almost anything on the corporate network.
Why restricting what the agent does wasn't the answer
Restricting the agent's tools kills the very capability that makes it useful. Franceschi said Nvidia's NemoClaw takes that approach, and he believes it neutralises the coding abilities that give agents their value. Take away its ability to write and run code and you've taken away the point.
So Brex flipped the problem. Instead of policing what OpenClaw could do inside its container (a self-contained software environment, like a sealed room), the company decided to watch the door. Our 5 August story "How AI Agents Could Breach Your Network Without Proper Controls" flagged exactly this gap a week before Brex went public with its solution.
What CrabTrap actually does
CrabTrap sits between the agent and the internet. Every time the agent tries to send or receive data, CrabTrap checks the request.
For routine, low-risk actions, a set of pre-approved rules decides instantly. A recruiting agent viewing a LinkedIn profile gets waved through with no delay.
For higher-risk actions like sending an email, the request goes to an LLM judge. An LLM, or large language model, is the AI technology that powers chatbots like ChatGPT. Here it reads the network request and decides whether it fits the agent's approved purpose. Because LLMs have been trained on billions of web pages and network requests, they already understand what normal traffic looks like, and Franceschi said that judgment ability emerges without heavy instructions.
The slow AI check touches only about 2% of requests. Everything else is near-instant.
What happens when the agent hits a wall?
When the LLM judge blocks an action, CrabTrap sends a message to a human manager on Slack, explaining what the agent was trying to do and suggesting a rule change that would allow it next time. The manager clicks yes or no. The rules update.
Brex tested the system with a virtual recruiter named Jim, built on OpenClaw. Jim sources candidates, scores applicants and sends emails. If Jim tries something outside its approved policy, a human decides whether to expand that policy. "When an employee hits a wall, they escalate to their manager," Franceschi said. He believes the virtual-employee framing, complete with a Slack presence and an email address, is more useful than the word "agent."
Brex had no commercial tool that satisfied its security team, so it built CrabTrap itself. Franceschi was candid that a commercial product will probably make it redundant. What mattered, he said, was the months of real experience deploying agents safely.
The plain judgement here: Brex's honest admission that it's probably building something disposable is the most useful thing a security team at any company can hear right now. Most vendors won't say that.
Watch for this: If your company is evaluating AI agents, ask vendors specifically how outbound network activity is monitored. Tool restrictions alone may not satisfy your security team, and that's a reasonable instinct worth taking seriously.
