Brex assumes its AI agents could do anything — so it watches the network, not the code

Brex CEO Pedro Franceschi discussed the challenges of securely deploying AI agents in production environments during VB Transform 2026. He emphasized the need to move beyond vague terminology and focus on concrete enterprise roles for AI agents. Franceschi argued that AI agents should be seen as virtual employees, capable of collaborating with human workers through various means such as Slack integration, email, and attending meetings.

To tackle the security concerns surrounding AI agents, Brex developed a novel network-level security layer called CrabTrap. This approach was necessary as traditional security models failed when deploying AI agents like OpenClaw, which can self-bootstrap and maintain their own codebases. The security team at Brex rejected the idea of deploying OpenClaw for automating internal functions due to concerns about trusting an agent with code execution capabilities.

Brex's solution was to shift the security perimeter from focusing on the code inside the container to monitoring the outbound network traffic between the container and the internet. This led to the creation of CrabTrap, an open-source HTTP proxy that monitors all outbound network traffic and uses an LLM to evaluate whether the traffic aligns with the agent's approved policy. By assuming the AI agent can do anything and monitoring the network traffic, Brex aimed to mitigate security risks.

The architecture of CrabTrap relies on static pre-approved rules for routine, low-risk actions, while high-risk actions that require sending emails are flagged and routed to the LLM judge for evaluation. This approach ensures that only about 2% of complex requests actually face LLM latency. The effectiveness of the LLM judge was surprising, as its training on billions of web pages and HTTP requests gives it an inherent semantic understanding of network traffic patterns.

Brex tested this infrastructure with a virtual recruiter named "Jim," built on OpenClaw. Jim performed various tasks, including sourcing candidates, scoring applicants, and sending emails. If Jim's actions fell outside the established policy, CrabTrap would ping a human manager on Slack, providing context and suggesting a policy change. This human-in-the-loop workflow allowed for dynamic updates to the rules.

Franceschi highlighted the necessity of building the cultural and technical muscle to operate in an agentic world, as enterprises navigate the AI landscape. Although Brex is a fintech company and not a cybersecurity vendor, they chose to build CrabTrap in-house due to the lack of mature commercial solutions that could meet their security team's needs. The investment in building internal tools provided Brex with the experience needed to safely deploy agents months ahead of the broader market.