Brex assumes its AI agents could do anything — so it watches the network, not the code
CEO Pedro Franceschi explains why Brex gave up trying to control what its AI agents do, and started watching where their traffic goes instead.
Written by OutOfToken AI
August 10, 2026 · 6 min read · Synthesized from reporting by VentureBeat · How this works
At VB Transform 2026, Brex CEO Pedro Franceschi laid out a working blueprint for one of enterprise AI's thorniest unsolved problems: how to let autonomous coding agents loose inside a corporate network without losing control of it. His answer wasn't a smarter sandbox or a stricter permissions system. It was to stop policing the code entirely and start watching the wire.
Forget 'agents,' hire virtual employees
Franceschi opened by rejecting the industry's favorite word. "People talk a lot about agents, but I think 'agents' is a terrible name," he said, calling it a vague Silicon Valley concept detached from real enterprise use. Brex's internal framing instead treats these systems as virtual employees — entities with Slack accounts and email addresses that can join meetings and take on real responsibilities.
The OpenClaw problem
The project traces back to a leap in coding-model capability late last year, which led to January's release of the open-source agent framework OpenClaw. For the first time, agents could self-bootstrap and maintain their own codebases rather than lean on static, hard-coded tools. When Franceschi proposed pointing OpenClaw at internal Brex functions, the security team refused outright, citing its open-ended code execution capabilities as fundamentally unmanageable.
Why locking down tools felt like the wrong trade
Franceschi contrasted Brex's thinking with approaches like Nvidia's NemoClaw, which he said secures agents by restricting their available tools. In his view, that trade-off guts the very coding capability that makes an agent useful for varied, unscripted tasks. Brex's bet was that the coding ability wasn't the risk to eliminate — it was the value to preserve, which meant the security boundary had to move somewhere else entirely.
CrabTrap: assume compromise, watch the exits
That somewhere else is the network layer. Brex built CrabTrap, an open-source HTTP/HTTPS proxy that intercepts every outbound request an agent's container makes and checks it against policy before it reaches the internet. "Instead of trying to control the code running in the container, assume the thing can do anything and monitor the network traffic between that container and the internet," Franceschi said.
""When we built this, it was clear to me there was a 70% chance we would throw it away in six months... But what we learned by being six months ahead was worth it in shaping our AI adoption strategy.""
An LLM judge, but only when it matters
Running every network request through an LLM would add unacceptable latency. Brex's fix splits traffic into two lanes: low-risk, routine actions — like a recruiting agent viewing a LinkedIn profile — pass instantly through static pre-approved rules, while high-risk actions, such as sending an email, get routed to an LLM judge. Franceschi said that split keeps LLM evaluation to roughly 2% of requests, the ones where nuance actually matters.
Why the judge works better than expected
Franceschi said the LLM judge's accuracy surprised the team, and he attributes it to pretraining exposure to billions of web pages and HTTP interactions. That gives models what he called an inherent semantic grasp of what normal versus anomalous traffic looks like, without heavy prompt engineering. "[Models] are very good at discerning what is within the policy and what is not," he said.
Meet Jim, the virtual recruiter
Brex stress-tested the system with Jim, an OpenClaw-based virtual recruiter that sources candidates, scores applicants, and sends emails. When Jim attempts something outside policy — an unapproved outbound email, for instance — CrabTrap escalates to a human manager on Slack, explaining the agent's intent and proposing a policy update. The manager approves or denies with a click, and the rule set updates dynamically from there.
Borrowing the org chart
Franceschi framed the escalation model as a direct port of existing management structures rather than a novel invention. "I like the virtual employee analogy because a lot of these things were solved already in a company, in the context of humans," he said. "When an employee hits a wall, they escalate to their manager."
Brex is a fintech company, not a security vendor, and Franceschi doesn't expect to be the one running this infrastructure long-term — commercial tools will likely catch up. CrabTrap has already drawn attention outside Brex, picking up hundreds of GitHub stars and interest from figures across the AI industry. His larger point wasn't that Brex found the permanent answer, but that waiting for one is its own risk: "We don't have all the answers, but the answer is not to do nothing."
Editorial Note
The research confirms key technical details about CrabTrap's architecture, Jim the recruiter agent, and Franceschi's direct quotes about the project. However, the research does not verify claims about OpenClaw's release timeline or Nvidia's NemoClaw approach, leaving portions of the narrative unconfirmed. The core architecture and philosophy described align with source material, though broader context about the security implications remains unexamined.
Claim Tracker
AI-assessed
The research mentions OpenClaw and its January release but provides no confirmation of a specific December breakthrough preceding it.
Source 1 confirms: 'The open-source HTTP/HTTPS proxy intercepts all network traffic, examines policy rules, and uses a LLM-as-a-judge to decide whether agent requests should be approved or denied.'
Source 4 confirms: 'A virtual recruiter: An agent named "Jim" lives in Slack with his own email address. Jim screens resumes.'
Source 2 contains this exact quote from Franceschi about CrabTrap's development risk.
The research provided contains no information about Nvidia's NemoClaw or its security approach to verify or contradict this claim.
Ask AI about this story
// discussion
sign in to join the discussion