Brex Built an AI Security Proxy That Watches What Agents Do on the Network

Quick Facts

• Brex open-sourced CrabTrap, an HTTP proxy that controls how AI agents access APIs, credentials, and external services at the network layer.
• An LLM judge evaluates requests that fall outside known traffic patterns, but activates for fewer than 3% of requests once an agent establishes predictable behavior.
• CrabTrap is framework-agnostic and language-agnostic, requiring no SDK wrappers or per-tool integration to deploy.

Brex has open-sourced an internal security tool called CrabTrap that monitors AI agent behavior at the network level rather than the application level. The corporate spend management company built the platform after concluding that existing guardrails were either too restrictive or too difficult to scale.

The tool operates as an HTTP and HTTPS proxy positioned between an AI agent and every outbound network request. It intercepts traffic, checks it against policies, and decides whether to approve or block the request before it reaches a production API.

Why the Network Layer

Brex co-founder and CEO Pedro Franceschi said the team identified an enforcement gap that most companies were ignoring. “What we noticed was that the network layer was an untapped enforcement point,” Franceschi told VentureBeat. “Every request an agent makes is an opportunity to intercept, reason about, and make a policy decision.”

The company did not abandon other security measures. Franceschi described the approach as “security by layers,” with the transport layer being an underinvested one where Brex saw room to add enforcement alongside existing controls.

How the System Works

CrabTrap uses a three-step decision process. First, it terminates TLS by generating a per-host certificate and decrypting the request. Second, it matches the request against static URL rules. If a rule matches, the decision is immediate and no AI model is called. Deny rules always take priority.

If no static rule applies, an LLM judge evaluates the request against a natural-language security policy the team writes for each agent. Allowed requests are forwarded. Blocked requests receive a 403 response with a reason. Every request and decision is logged to PostgreSQL.

Operators configure the proxy by setting HTTP_PROXY and HTTPS_PROXY environment variables. No code changes are required in the agent itself.

The 3% Threshold

Brex said the LLM judge activates for fewer than 3% of requests once an agent has run long enough to establish predictable behavior. Static rules handle the rest, keeping latency low and costs manageable.

The company also built a policy generator that watches agent traffic in shadow mode before rules go live. The tool samples real requests and drafts natural-language policies based on actual agent behavior. A separate evaluation system stress-tests proposed policies against historical traffic before they are deployed.

Prompt Injection Defenses

Building an LLM into a security enforcement path creates its own risks. An attacker who controls a URL, header, or request body could craft content designed to manipulate the judge’s decision.

Brex addressed this by converting each request into a structured JSON object before sending it to the model. “All user-controlled content is escaped rather than interpolated as raw text,” Franceschi said. Security-relevant headers are prioritized, total header content is capped at 4KB, and request bodies are truncated at 16KB. Multipart requests are replaced with a structured summary rather than sent raw.

CrabTrap also includes SSRF protection, blocking requests to private network ranges with DNS-rebinding prevention built in.

Business Context

Brex serves more than 35,000 companies and crossed $500 million in annualized revenue in 2025 after a period of turbulence that included a 20% workforce reduction in 2024. The company says AI now automates 80% of underwriting decisions in 60 seconds, and its enterprise business grew 91% last year.

CrabTrap has collected more than 700 GitHub stars since Brex released it publicly. The company’s broader AI infrastructure, called OpenClaw, underpins the agent workflows that CrabTrap was built to secure.

For founders running AI agents against production systems, the core takeaway is operational: governing agents at the SDK level does not scale as capability grows. A centralized network control plane that learns from real agent behavior may offer a more durable path.

Read more: Brex assumes its AI agents could do anything — so it watches the network, not the code