Brex CrabTrap Secures OpenClaw AI Agents at the Network Layer
Brex built open source CrabTrap to police OpenClaw network traffic, routing risky requests to an LLM judge so only about 2% of complex requests face added latency.
Summary
At VB Transform 2026, in a VentureBeat report published August 10, 2026, Brex CEO Pedro Franceschi urged enterprises to replace the vague “agent” concept with a “virtual employee” that uses Slack and email, joins meetings and collaborates with staff. Coding models matured in December, enabling OpenClaw’s January release and agents that bootstrap and maintain their own codebases instead of relying on static tools. Brex’s security team initially rejected internal deployment because OpenClaw can execute code. Franceschi said Nvidia’s NemoClaw limits tool use and therefore weakens the coding capability needed for varied work, so Brex instead assumed OpenClaw could do anything or already be compromised.
Brex built CrabTrap, an open source HTTP proxy that monitors outbound traffic between an agent container and the internet rather than policing changing code. Static rules instantly permit low-risk traffic, such as a recruiting agent viewing LinkedIn, while risky actions, including email, go to an LLM judge. Only about 2% of complex requests incur the delay of thousands of milliseconds. Franceschi said models distinguish policy-compliant traffic with little prompting because pretraining covers billions of webpages and HTTP requests. Brex’s OpenClaw recruiter, Jim, sources candidates, scores inbound applicants and sends emails. If CrabTrap flags an unapproved email, Slack tells a human manager Jim’s intent, proposes a policy change and lets the manager approve or reject it, dynamically updating the rules.
Brex, a fintech company rather than a cybersecurity vendor, built CrabTrap because no mature commercial product satisfied its security team. Franceschi assigned a 70% chance that Brex would discard it within six months as vendors catch up, but said operating six months ahead shaped its AI adoption strategy and enabled safe deployment months before the broader market. He urged enterprises to build technical and cultural capability now despite unresolved questions.
Positives
- Only about 2% of complex requests reach CrabTrap’s LLM judge, preserving instant handling for routine, pre-approved traffic.
- CrabTrap is an open source HTTP proxy that protects agents without removing their general code execution capabilities.
- Jim already sources candidates, scores inbound applicants and sends emails as Brex’s OpenClaw-based virtual recruiter.
- Slack approvals let human managers review flagged intent and dynamically approve, reject or amend an agent’s policy.
- Six months of early operating experience helped shape Brex’s AI adoption strategy and supported deployment months ahead of the broader market.
Risks & concerns
- OpenClaw’s unrestricted code execution led Brex’s security team to reject its initial internal deployment proposal.
- Thousands of milliseconds can be added when an LLM evaluates a network request, making universal LLM review impractical.
- No mature commercial security product met Brex’s requirements, forcing the fintech company to build CrabTrap internally.
- A 70% chance of discarding CrabTrap within six months reflects the cost and rapid obsolescence risk of frontier infrastructure.
- Nvidia’s NemoClaw limits agent tools, an approach Franceschi argues can neutralize the coding flexibility that makes agents valuable.
