Brex built a network watchdog for its AI agents because it assumed they were already compromised

Key points

• Brex released OpenClaw, an open-source AI coding agent, in January 2025, after coding models reached a new level of maturity in December 2024.
• Brex's security team initially rejected deploying AI agents internally because the agents could execute code freely on the corporate network.
• Brex built CrabTrap, an open-source network proxy, to monitor outbound traffic from AI agents rather than trying to restrict what the agents could do.
• Only about 2% of agent requests face a slow AI-based review; routine actions pass through instant pre-approved rules.
• Brex CEO Pedro Franceschi estimated a 70% chance the tool would be thrown away within six months, but said the experience gained was worth the investment.

Brex CEO Pedro Franceschi had a problem. His company had built an AI agent, a piece of software that can carry out multi-step tasks on its own, called OpenClaw. He wanted to put it to work inside Brex. His security team said no.

"Hell no. How could we trust an agent doing these things?" was how Franceschi described the reaction, speaking at VB Transform 2026 and first reported by VentureBeat. The concern was real: OpenClaw could write and run its own code, which meant, in theory, it could do almost anything on the corporate network.

Why restricting what the agent does wasn't the answer

Restricting the agent's tools, which is the approach Franceschi said Nvidia's NemoClaw takes, kills the very capability that makes the agent useful. If you take away its ability to write and run code, you take away its value.

So Brex flipped the problem. Instead of policing what OpenClaw could do inside its container (a self-contained software environment, like a sealed room), the company decided to watch the door.

What CrabTrap actually does

CrabTrap sits between the agent and the internet. Every time the agent tries to send or receive data, CrabTrap checks the request.

For routine, low-risk actions, a set of pre-approved rules decides instantly. A recruiting agent checking a LinkedIn profile? Waved through. No delay.

For higher-risk actions, like sending an email, the request goes to an LLM judge. An LLM, or large language model, is the AI technology that powers chatbots like ChatGPT. Here it reads the network request and decides whether it fits within the agent's approved purpose. Because LLMs have been trained on billions of web pages and network requests, they already understand what normal-looking traffic looks like. Franceschi said this judgment ability appears naturally, without heavy instructions.

The slow AI check only touches about 2% of requests. Everything else is near-instant.

What happens when the agent hits a wall?

When the LLM judge blocks an action, it does not just stop silently. CrabTrap sends a message to a human manager on Slack, explaining what the agent was trying to do and suggesting a rule change that would allow it next time. The manager clicks yes or no. The rules update.

Brex tested the whole system with a virtual recruiter named Jim, built on OpenClaw. Jim sources job candidates, scores incoming applications, and sends emails. When Jim tries something outside its approved policy, a human decides whether to expand that policy.

"When an employee hits a wall, they escalate to their manager," Franceschi said. The analogy is deliberate: he believes the virtual-employee framing, with a Slack presence, an email address, and a human chain of oversight, is more useful than the word "agent."

Brex is a fintech company and had no commercial tool that satisfied its security team, so it built CrabTrap itself. Franceschi was candid that a commercial product will probably make it redundant. The point, he said, was the months of real experience deploying agents safely, not the tool itself.

Watch for this: If your company is evaluating AI agents, ask vendors specifically how outbound network activity is monitored. Tool restrictions alone may not satisfy your security team, and that is a reasonable instinct worth taking seriously.