Brex CEO Pedro Franceschi says companies need security models built for AI agents that can write code and act across business systems. The company built CrabTrap, an open-source network control layer, after its security team rejected a wider OpenClaw deployment.
For employers trying to move AI agents from experiments into daily operations, the hard part is no longer just whether the software can complete a task. It is whether managers, security teams and employees can trust it enough to let it touch real workflows.
That was the issue Brex CEO Pedro Franceschi described at VB Transform 2026, where he outlined how the fintech company approached OpenClaw, an open-source AI agent, and the controls it built before using such systems inside the business.
Franceschi argued that companies should be more precise about what they are building. The word agent, he said, can obscure the practical question of how these systems fit into teams.
“People talk a lot about agents, but I think 'agents' is a terrible name. It's this Silicon Valley concept that doesn't really mean much,” Franceschi said.
His preferred framing is closer to a digital colleague with defined permissions and escalation paths. “The concept we always had in mind was the idea of a virtual employee, someone on Slack, an entity, it has an email address, it can join meetings, you can email it, and that you can work with,” he said.
Why old controls did not satisfy Brex
According to Franceschi, the opportunity opened after coding models improved in December, making it possible for OpenClaw to be released in January. The significance, in his telling, was that these systems could begin to create and maintain parts of their own codebases rather than depend only on fixed, pre-built tools.
That capability is also what made the proposal difficult for Brex security leaders. When Franceschi suggested using OpenClaw for internal automation, the response was blunt.
“They said, 'Hell no. How could we trust an agent doing these things? This thing has code execution capabilities. There's no way to control it,'” Franceschi said.
The objection points to a broader enterprise problem. A tool that can write and execute code may be more flexible than a chatbot or a workflow script, but it also challenges familiar security boundaries. If a company gives such a system access to corporate systems, limiting risk requires more than ordinary identity management or endpoint controls.
Franceschi contrasted Brex's approach with systems such as Nvidia's NemoClaw, which he said seek to secure agents by restricting what tools they can use. He argued that this can undermine the very capability that makes coding agents useful across varied business tasks.
“… the premise we had was that the coding capabilities were critical to the model having the ability to do a variety of tasks,” he said.
CrabTrap shifts oversight to the network
Brex responded by building CrabTrap, an open-source HTTP proxy. In plain English, a proxy sits between software and the internet, watching and controlling the requests that pass through it.
The design starts from a conservative assumption: OpenClaw might do anything, and it might already be compromised. Instead of trying to understand or restrict every piece of code running inside a container, Brex watches what that code tries to send out or pull in.
“Instead of trying to control the code running in the container, assume the thing can do anything and monitor the network traffic between that container and the internet,” Franceschi said.
CrabTrap uses a large language model, or LLM, as a judge to decide whether network activity fits the policy approved for that agent. Applying an LLM to every request would be too slow, Franceschi said, adding thousands of milliseconds to response times. So Brex split the work.
Common, low-risk activity runs through static approved rules. For example, if a recruiting agent looks up a LinkedIn profile, a rule can allow that without waiting for model review. Riskier actions, including sending email, are sent to the LLM judge. Franceschi said this means only about 2% of complex requests take on LLM latency.
He said the company found the model was unexpectedly strong at this kind of review, because LLMs are trained on billions of web pages and HTTP requests. In his view, that gives them a useful grasp of the meaning and pattern of network activity.
“[Models] are very good at discerning what is within the policy and what is not,” Franceschi said.
Human managers remain part of the system
Brex tested the setup with “Jim,” a virtual recruiter built on OpenClaw. Jim can source candidates, score inbound applicants and send emails.
When Jim attempts something beyond its current policy, CrabTrap does not simply let the software decide for itself. It brings in a person. If the LLM judge flags an outbound email that has not been authorized, CrabTrap alerts a human manager in Slack. The message explains what the agent is trying to do and proposes a policy change. The manager can approve or reject it, updating the rules as work evolves.
For leaders designing AI workflows, that detail matters. The model is not replacing management judgment. It is creating a new kind of escalation queue, where humans set boundaries and refine them as the system encounters edge cases.
“I like the virtual employee analogy because a lot of these things were solved already in a company, in the context of humans,” Franceschi said. “When an employee hits a wall, they escalate to their manager.”
Brex is not a security vendor, and Franceschi acknowledged that building CrabTrap internally may not remain necessary for long. Commercial tools are likely to mature. But he said the company decided the learning was worth the cost of moving early.
“When we built this, it was clear to me there was a 70% chance we would throw it away in six months... But what we learned by being six months ahead was worth it in shaping our AI adoption strategy,” he said.
His closing message for executives was not that every company should build its own proxy. It was that human-led AI adoption requires both technical controls and organizational habits, including clear roles, approved policies and escalation to accountable managers.
“We don't have all the answers, but the answer is not to do nothing,” Franceschi said.
Reported by Hybrion Insights with reference to VentureBeat AI.
hybrion
Better together. Built for what's next.
Stay updated
Get insights on AI, teams, and the future of work.
