How Brex Solved the Agent Security Problem by Watching the Network
The fintech built CrabTrap, an HTTP proxy that uses LLMs to judge network traffic in real time, enabling AI agents to run production tasks without traditional code-level controls.
The Virtual Employee Problem
When Brex wanted to deploy AI agents for internal operations earlier this year, the security team's answer was immediate: absolutely not. The prospect of granting code execution privileges to an autonomous system inside the corporate perimeter violated every principle of traditional application security. Yet the fintech company needed a way forward. Coding models had matured to the point where agents could bootstrap themselves, write their own tooling, and maintain their own codebases. The value proposition was too large to ignore.
The company's CEO, Pedro Franceschi, reframed the challenge by ditching the term "agent" altogether. The concept Brex pursued instead was what he calls the virtual employee: an entity with a Slack handle, an email address, and the ability to join meetings and collaborate with human colleagues. That framing clarified the security requirements. If a human employee can send an email or pull a LinkedIn profile, a virtual one should be able to do the same, subject to similar oversight and policy constraints.
The question was how to build that oversight without gutting the capabilities that made agents useful in the first place.
Code Inspection Is a Losing Game
Traditional application security assumes you can audit the code running inside a container. That model breaks down when the code is self-modifying, generated on the fly by a language model, and constantly evolving to meet new tasks. Franceschi describes the dilemma: the security team wanted guarantees about what the agent could and could not do, but the agent's strength lay precisely in its ability to write and execute arbitrary code to solve unforeseen problems.
Some approaches, like Nvidia's NemoClaw framework, address this by restricting agents to a whitelist of pre-approved tools. Franceschi sees that as a non-starter. Limiting tool usage neutralizes the coding capabilities that give agents their adaptability. If you constrain an agent to a fixed set of functions, you end up with an elaborate state machine, not a virtual employee.
Brex took a different path. Instead of trying to control what the agent writes, the company decided to monitor what the agent tries to communicate with the outside world. The security perimeter moved from the code layer to the network layer.
CrabTrap: An HTTP Proxy That Thinks
The result is CrabTrap, an open-source HTTP proxy that sits between the agent's container and the internet. The design assumes the agent is already compromised and capable of doing anything. Every outbound network request passes through CrabTrap, which evaluates whether that request aligns with the agent's approved policy.
The evaluation happens in two tiers. Routine, low-risk actions pass through static rules with zero added latency. If a recruiting agent queries a LinkedIn profile, the proxy allows it instantly. High-risk actions, like sending an email or accessing a financial API, trigger a secondary review. CrabTrap routes the request to a large language model, which judges whether the action fits within the established policy.
Franceschi estimates that only around two percent of requests require LLM evaluation. That architecture keeps latency manageable. Passing every request through an LLM would add thousands of milliseconds to response times, making the system unusable. The bifurcated design ensures that most traffic flows at full speed while the proxy scrutinizes only the actions that matter.
Why LLMs Are Good at Judging Network Traffic
One of the surprises in building CrabTrap was how well language models perform as security judges. Franceschi attributes this to pre-training. Modern LLMs ingest billions of web pages and HTTP requests during training, giving them a semantic understanding of what network traffic patterns typically look like. When presented with an outbound request, the model can assess whether the payload and destination align with the agent's stated role.
That capability emerges naturally, without heavy prompt engineering or fine-tuning. The models are already familiar with the structure of HTTP headers, JSON payloads, and URL patterns. They can discern intent from context, distinguishing between a legitimate API call and an anomalous data exfiltration attempt.
Brex did not need to build a custom security model or train a specialized classifier. The general-purpose language models already in production were sufficient to handle the task. That realization simplified deployment and reduced the overhead of maintaining a separate security stack.
Jim the Recruiter and Human-in-the-Loop Workflows
Brex put the system to work with Jim, a virtual recruiter built on OpenClaw. Jim handles candidate sourcing, scores inbound applications, and drafts outreach emails. When Jim attempts an action outside the approved policy, CrabTrap escalates to a human manager via Slack. The notification explains what Jim is trying to do and suggests a policy update that would permit the action. The manager reviews the context and approves or denies the request with a single click.
Franceschi draws a direct analogy to how human employees operate. When a worker encounters a roadblock, they escalate to their manager. The virtual employee model replicates that workflow, preserving human oversight without requiring constant supervision. Over time, as policies evolve and edge cases are resolved, the agent gains autonomy while remaining accountable.
The escalation mechanism also serves as a feedback loop. Each approval or denial refines the static rule set, reducing the frequency of future escalations. The system learns which actions are routine and which require judgment, gradually shifting more traffic to the fast path.
The Cost of Building at the Frontier
Brex is a fintech company, not a cybersecurity vendor. The decision to build CrabTrap internally was driven by necessity, not strategic ambition. No commercial solution on the market could satisfy the security team's requirements while preserving the agent's full capabilities. Franceschi acknowledges the trade-off: building at the bleeding edge means investing in infrastructure that may become obsolete as vendor offerings mature.
He estimates there was a seventy percent chance the company would discard CrabTrap within six months. But the six-month head start gave Brex the operational experience needed to deploy agents safely and confidently. That experience shaped the company's broader AI adoption strategy, informing decisions about governance, risk tolerance, and organizational readiness.
For enterprises weighing similar investments, the calculus is straightforward. The cost of building custom infrastructure is high, but the cost of waiting may be higher. Commercial vendors will eventually catch up, but the companies that learn to operate in an agentic environment today will have a structural advantage in speed, adaptability, and institutional knowledge.
What the Network Layer Teaches Us
The shift from code inspection to network monitoring represents a broader principle: in an agentic world, you cannot audit every line of generated code, but you can audit every action that crosses a trust boundary. The network layer is a natural chokepoint. It is observable, instrumentable, and consistent regardless of what happens inside the container.
That insight extends beyond AI agents. As software systems become more dynamic and self-modifying, traditional static analysis tools lose effectiveness. Security architectures will need to focus on behavior rather than implementation, on outcomes rather than instructions. The proxy model is one expression of that shift, but the underlying idea applies wherever code generation and execution happen at runtime.
Brex's approach also highlights the role of language models as infrastructure, not just application features. The LLM-as-judge pattern treats the model as a semantic evaluation engine, capable of making context-aware decisions about network traffic, policy compliance, and intent recognition. That capability opens up new design possibilities for security, observability, and governance tooling across the stack.
The Virtual Employee Era
Franceschi's framing of agents as virtual employees is more than a branding exercise. It clarifies the product requirements, the security model, and the organizational workflows needed to make agents practical. A virtual employee needs identity, accountability, escalation paths, and oversight, just like a human one. The tools and policies that govern human collaboration can be adapted to govern agent collaboration, provided the infrastructure exists to enforce those policies at runtime.
CrabTrap is Brex's answer to that infrastructure challenge. Whether it becomes a widely adopted open-source tool or a temporary internal solution, the architecture it demonstrates is likely to persist. As more enterprises deploy agents into production, the network layer will become the primary control plane. The code inside the container will remain opaque and dynamic, but the traffic crossing the boundary will be legible and enforceable.
The next phase of enterprise AI adoption will be defined not by better models or cheaper inference, but by the operational muscle to deploy those models safely at scale. Brex built that muscle by assuming the agent could do anything and focusing on what it actually tried to do. That inversion of the security model is the blueprint for making virtual employees real.
