Brex developed an unconventional approach to AI agent security by observing actual agent behavior rather than imposing predetermined rules. The fintech company discovered that traditional guardrails fail when agents handle real credentials like API keys and OAuth tokens.
Brex built CrabTrap, an open-source HTTP/HTTPS proxy that intercepts all network traffic from AI agents and evaluates requests against policy rules. Rather than hard-coding restrictions, the system uses a large language model as a judge to determine whether individual agent requests should proceed or get blocked.
This inversion of the typical security approach matters because agentic AI systems operate differently than traditional software. Agents explore multiple paths to accomplish goals, make autonomous decisions, and often need broad access to function effectively. Restricting them upfront creates friction that defeats their purpose.
The CrabTrap framework monitors all outbound connections from agents in real time. When an agent attempts an action, the system evaluates it contextually against defined policies rather than matching against a static list of approved or forbidden operations. An LLM engine makes judgment calls on edge cases and ambiguous scenarios where simple rule-based filtering would either block legitimate actions or allow harmful ones.
Brex's findings align with emerging consensus in enterprise AI deployment. Companies like Anthropic and others have documented that agents trained on adversarial examples can circumvent traditional access controls. The OpenClaw framework, despite becoming widely adopted, has struggled to prove itself at enterprise scale precisely because its security model assumes agents behave predictably.
By publishing CrabTrap as open source, Brex shares its learnings with the broader community. Other companies deploying agents at scale face identical challenges: agents need real access to perform useful work, but that access creates risk. The proxy-based interception model sidesteps the false choice between locking agents down completely or granting them unfettered access.
The practical