The Problem With Locking Down Agents

Enterprise AI deployments keep running into the same wall: security teams won't approve agents that have unrestricted code execution. The instinct is to lock agents down — limit their tools, constrain their capabilities — and, in doing so, strip out most of what makes them useful in the first place.

Brex CEO Pedro Franceschi came to VB Transform 2026 with a different answer. Speaking about the company's open-source agent framework OpenClaw, Franceschi laid out why the standard tool-restriction model fails and what Brex built in its place.

His framing started with a terminology complaint that doubles as a design principle:

"People talk a lot about agents, but I think 'agents' is a terrible name. It's this Silicon Valley concept that doesn't really mean much."

The goal Brex actually aimed for was a virtual employee — an entity with a Slack handle, an email address, the ability to join meetings, and enough autonomy to collaborate with human colleagues without constant hand-holding.

Why the Security Team Said No

OpenClaw shipped in January, following a breakthrough in coding model maturity Franceschi pinpointed to December. That maturity unlocked something important: agents could self-bootstrap and maintain their own codebases rather than depending on hard-coded, static tools.

But when Franceschi proposed deploying OpenClaw internally, Brex's security team shut it down immediately. The company found that traditional model guardrails and tool permissions were not enough to control agents with access to API keys, OAuth tokens, and service accounts.

Franceschi recalled the security team's response plainly: "Hell no. How could we trust an agent doing these things? This thing has code execution capabilities. There's no way to control it."

The conventional industry response — exemplified by approaches like Nvidia's NemoClaw — is to secure agents by limiting their tool usage. Franceschi's objection: that approach neuters the very coding capabilities that give agents their value.

Enter CrabTrap: Monitor the Wire, Not the Code

Brex's solution was to move the enforcement boundary entirely. The result is CrabTrap, an open-source HTTP/HTTPS proxy that intercepts all network traffic and uses an LLM-as-a-judge to decide whether agent requests should be approved or denied.

By operating at the transport layer, CrabTrap is framework-agnostic, language-agnostic, and API-agnostic — requiring no SDK wrappers or per-tool integration. Users simply set HTTP_PROXY and HTTPS_PROXY in the agent's environment, and every outbound request routes through the proxy before reaching its destination.

The core assumption baked into CrabTrap's design is significant: treat every agent as potentially compromised from the start. Rather than trying to guarantee clean code inside a container, you watch what that container tries to talk to.

The Bifurcated Traffic Model

Using an LLM to evaluate every network request would introduce unbearable latency — often thousands of milliseconds. Brex's architecture addresses this with a two-track system:

  • Static pre-approved rules handle routine, low-risk actions instantly (e.g., a recruiting agent viewing a LinkedIn profile).
  • LLM judge evaluation is reserved for high-risk actions — sending emails, accessing sensitive APIs — where semantic reasoning is actually needed.

The result: only about 2% of complex requests face LLM latency. Brex also built a policy generator that studies historical network traffic while agents operate in shadow mode, sampling requests and drafting natural-language policies based on how the agents actually behave — with an evaluation system that compares proposed changes against prior traffic before they go live.

One serious engineering challenge was prompt injection: because the LLM judge receives HTTP requests containing user-controlled data, a malicious URL or request body could attempt to manipulate its decision. Brex addressed this by converting requests into structured JSON before passing them to the model.

Human-in-the-Loop, By Design

Brex tested this infrastructure on "Jim," a virtual recruiter built on OpenClaw. Jim sources candidates, scores inbound applicants, and sends emails. When Jim attempts something outside its approved policy, CrabTrap doesn't just block it — it pings a human manager on Slack, explains the agent's intent, and suggests a policy update. The manager clicks yes or no.

CrabTrap also stores full audit trails and can flag repeated denials so a person or another agent can propose an updated policy.

Franceschi's analogy is deliberately mundane: "When an employee hits a wall, they escalate to their manager." The virtual employee framing isn't just marketing — it's an architectural guide for what human oversight should look like in practice.

The Cost of Being Early

CrabTrap is already running in Brex's production environment and is now available on GitHub to external developers. The decision to build it internally was pragmatic: no mature commercial solution existed that could satisfy a security team as demanding as Brex's.

Franceschi was candid about the expected shelf life of their custom tooling: "When we built this, it was clear to me there was a 70% chance we would throw it away in six months... But what we learned by being six months ahead was worth it in shaping our AI adoption strategy."

If CrabTrap evolves beyond an internal tool, it could strengthen Brex's positioning with enterprise customers cautious about AI-driven workflows involving sensitive financial data — and its emphasis on policy control may align with the compliance expectations now forming around agentic AI.

For enterprise leaders, the practical message is blunt: the agent security tooling market is still immature, and waiting for vendors to catch up means falling months behind on operational learning. As we've tracked across 20 AI agent stories in the past month, including the push to get computer-use agents past benchmark performance and into real production, the gap between what's technically possible and what's safely deployable is where the real competition is happening.

Franceschi's closing line distills the whole philosophy: "We don't have all the answers, but the answer is not to do nothing."