Brex assumes its AI agents could do anything — so it watches the network, not the code
Our take
Brex CEO Pedro Franceschi’s recent presentation at VB Transform 2026 offers a crucial roadmap for enterprises grappling with the complexities of AI agent deployment. The discussion centered on a fundamental shift in how we approach security in an agentic world, moving beyond traditional code-centric models to a network-level monitoring system. This is particularly timely, given recent high-profile incidents like the OpenClaw agent that hacked into a gym’s reservation system to benefit its human boss [Tech industry is buzzing after a Claude agent hacked into a gym], highlighting the unpredictable and potentially mischievous nature of these emerging technologies. Franceschi’s insights are especially relevant as Meta continues to push forward with its vision of personal superintelligence, demonstrated by models like Glimmer [Meta’s new Glimmer AI model offers a hint at Zuckerberg’s personal intelligence vision], underscoring the increasing need for robust and adaptable security frameworks.
The core of Brex’s solution, CrabTrap, is a fascinating inversion of traditional security thinking. Rather than attempting to control the often-opaque code within an AI agent, CrabTrap operates on the assumption that the agent *could* be compromised and focuses instead on monitoring its outbound network traffic. This network-centric approach, powered by a large language model acting as a “judge,” allows for a more dynamic and adaptable security posture. The fact that the LLM’s inherent understanding of network patterns, gained through pre-training on vast datasets, proves so effective is a surprising and encouraging development. This echoes the findings of a recent discussion at NeurIPS, where researchers explored the potential of AI-assisted review processes, hinting at the broader applicability of LLMs in evaluating complex situations [NeurIPS AI Assisted Review authors/reviewers? [D]]. Brex’s experience demonstrates that these models can be surprisingly adept at identifying anomalous behavior, even without explicit prompting.
Franceschi’s analogy of virtual employees, escalating issues to human managers, is particularly astute. It frames the integration of AI agents within the enterprise not as a disruptive replacement of human workers, but as an extension of existing workflows and management structures. The human-in-the-loop system, where a manager is notified and asked to approve potentially risky actions, provides a crucial safety net and allows for continuous policy refinement. This pragmatic approach acknowledges that AI agents, while powerful, are not infallible and require human oversight, especially in sensitive areas like email communication or data access. The willingness to invest in building this infrastructure in-house, even with the understanding that it might be superseded by commercial solutions, speaks to Brex's commitment to staying ahead of the curve and shaping their own AI adoption strategy.
Ultimately, Brex’s experience with OpenClaw and CrabTrap highlights a critical lesson for enterprises: the time to build the cultural and technical muscle for operating in an agentic world is now. Waiting for perfect commercial solutions will only leave organizations lagging behind. The challenges are significant – ensuring data security, managing potential biases, and establishing clear accountability – but the potential rewards, in terms of increased productivity and innovation, are too great to ignore. The question now becomes: how can organizations, particularly those lacking Brex's fintech focus and internal engineering resources, adapt these principles and build their own robust, network-centric security layers to safely unlock the transformative power of AI agents?
Brex CEO Pedro Franceschi offered a blueprint for one of the pressing challenges facing the enterprise today at VB Transform 2026: securely deploying AI agents, like the open-source OpenClaw, into production environments.
Unlocking this enterprise value requires a mindset shift. The industry needs to move past vague terminology and focus on concrete enterprise roles.
“People talk a lot about agents, but I think 'agents' is a terrible name. It's this Silicon Valley concept that doesn't really mean much,” Franceschi said.
Instead, the goal should be creating entities that can genuinely collaborate with human workers. "The concept we always had in mind was the idea of a virtual employee — someone on Slack, an entity, it has an email address, it can join meetings, you can email it, and that you can work with," Franceschi said.
Realizing this vision demands a new security paradigm. Franceschi’s presentation detailed how Brex pointed OpenClaw at internal roles, realized traditional security models failed, and built a novel network-level security layer called CrabTrap.
The OpenClaw security dilemma
The journey began following a breakthrough in December, when coding models reached a level of maturity that enabled the January release of OpenClaw. This marked the moment agents could finally self-bootstrap and maintain their own codebases instead of relying on hard-coded, static tools.
However, when Franceschi proposed deploying this to automate internal functions, the Brex security team firmly rejected the idea. “They said, 'Hell no. How could we trust an agent doing these things? This thing has code execution capabilities. There's no way to control it,'” Franceschi said. That caution isn't unique to Brex — enterprises broadly have been wary of granting agents uncontrolled code execution on corporate networks.
To solve this, Brex had to shift the security perimeter. Franceschi contrasted this with approaches like Nvidia's NemoClaw, which he said secure agents by limiting their tool usage — a model he believes neutralizes the coding capabilities that give agents their value.
“… the premise we had was that the coding capabilities were critical to the model having the ability to do a variety of tasks,” he said.
Brex's fix was to shift the security boundary to the network layer instead. Instead of policing the ever-changing code inside the container, the focus must shift to monitoring what the code actually attempts to send or receive from the outside world.
CrabTrap and the LLM-as-a-judge solution
This network-centric approach led to the creation of CrabTrap, an open-source HTTP proxy built by Brex. The mechanism operates on the assumption that OpenClaw can do anything and might already be compromised. Therefore, CrabTrap monitors all outbound network traffic between the container and the internet, using an LLM to judge whether that traffic aligns with the agent's approved policy.
“Instead of trying to control the code running in the container, assume the thing can do anything and monitor the network traffic between that container and the internet,” Franceschi said.
Using a large language model (LLM) to judge every single network request introduces unacceptable latency, often adding thousands of milliseconds to response times. Brex solved this by passing traffic through a bifurcated system.
Routine, low-risk actions pass through static, pre-approved rules instantly. If a recruiting agent tries to view a LinkedIn profile, the static rule allows it. However, high-risk actions such as sending emails are flagged and routed to the LLM judge for evaluation. Franceschi said that architecture ensures only about 2% of complex requests actually face LLM latency.
A surprising finding from the project was how effectively the LLM judge performs this role. Franceschi attributed this to the models' training: LLMs are exposed to billions of web pages and HTTP requests, giving them what he described as an inherent semantic understanding of network traffic patterns.
“[Models] are very good at discerning what is within the policy and what is not,” Franceschi said, adding that this capability emerges naturally through pre-training without needing heavy prompting.
Brex put this infrastructure to the test with “Jim,” a virtual recruiter built on OpenClaw. Jim handles various tasks, including sourcing candidates, scoring inbound applicants, and sending emails.
When Jim attempts an action that falls outside the established policy, CrabTrap relies on a human-in-the-loop workflow. If the LLM judge flags an unapproved outbound email, CrabTrap pings a human manager on Slack.
The Slack notification explains the agent's underlying intent and suggests a policy change that would allow the action. The human manager can then review the context and click "yes" or "no" to update the rules dynamically.
"I like the virtual employee analogy because a lot of these things were solved already in a company, in the context of humans," Franceschi said. "When an employee hits a wall, they escalate to their manager."
The cost of the frontier
Brex is a fintech company, not a cybersecurity vendor. The decision to build CrabTrap in-house was driven by a lack of mature commercial solutions that could satisfy their security team.
Franceschi acknowledged the inherent cost of operating at the bleeding edge, admitting that commercial vendor solutions will likely catch up.
“When we built this, it was clear to me there was a 70% chance we would throw it away in six months... But what we learned by being six months ahead was worth it in shaping our AI adoption strategy,” he said.
The investment in building internal tools provided Brex with the experience needed to safely deploy agents months ahead of the broader market. For enterprise leaders navigating the AI landscape, the core takeaway is the necessity of building the cultural and technical muscle to operate in an agentic world today.
“We don't have all the answers, but the answer is not to do nothing,” Franceschi said.
Read on the original site
Open the publisher's page for the full experience