Securing autonomous AI agents is one of the most urgent challenges for enterprises delegating complex tasks to AI systems. Brex, the fintech unicorn, has developed an innovative solution called CrabTrap, an open-source HTTP/HTTPS proxy that intercepts all agent network traffic and decides, with the help of an LLM-as-a-judge, which requests to approve or deny. The approach moves away from traditional SDK-level or model guardrails, shifting control to the network transport layer.
An untapped enforcement point: the transport layer
According to Pedro Franceschi, co-founder and CEO of Brex, the network layer was an overlooked enforcement point. Every agent request is an opportunity to intercept, reason, and make a policy decision. Existing solutions, such as fine-grained API tokens or semantic guardrails, proved weak: tokens can be misused, and semantic guardrails are vulnerable to prompt injection, especially when agents are connected to the internet. Brex decided to build a platform that sits between every agent and every network request, operating independently of framework, language, and API. Simply set the HTTP_PROXY and HTTPS_PROXY environment variables, and all traffic routes through CrabTrap.
Sponsored Protocol
The LLM judge and policy bootstrapping from real behavior
CrabTrap combines deterministic static rules with an LLM judge that fires only on 3% of requests, those to unknown endpoints or unusual patterns. However, the key innovation is the policy creation method: instead of writing rules from scratch, Brex built a policy builder that analyzes historical agent traffic in shadow mode, samples representative calls, and drafts a natural-language policy based on actual behavior. This approach, called bootstrapping from observation, proved far more effective than starting from a blank page.
To validate policies before deployment, Brex created an evaluation system that compares historical audit entries against the proposed policy, reporting exact changes. Replaying thousands of requests takes minutes, not hours, thanks to concurrent judge calls. Additionally, a live feedback loop stores logs in PostgreSQL and notifies a human or agent in case of continued denials, closing the loop between observation and refinement.
Sponsored Protocol
Technical challenges: latency and prompt injection
Latency was an initial concern, but using fast models like Claude Haiku and selective judge activation on a tiny fraction of requests made overhead negligible. The tougher challenge was protecting against prompt injection: the judge receives the full HTTP request, including user-controlled URL, headers, and body. Brex addressed this by structuring the request as a JSON object, escaping all user-controlled content before sending it to the model.
Results and organizational impact
The most significant impact of CrabTrap has been organizational confidence. Before its development, the team hesitated to deploy autonomous agents at scale. Now they have a trusted enforcement layer that allowed expanding agent use across more business areas. Moreover, the logs revealed how much noise agents generate, enabling tool optimization and reduction of unnecessary requests, saving both time and tokens. The proxy became a discovery tool, not just an enforcement one.
Sponsored Protocol
CrabTrap has been released as open source on GitHub and already garnered over 700 stars. Brex plans to integrate SSO, RBAC, escalation workflows, and programmatic configuration. The open-source community is encouraged to contribute, especially for diverse agent and policy use cases. As Franceschi stated, infrastructure gaps should not be excuses to wait. Building internal solutions like CrabTrap can make a difference. For more on the AI landscape, read our article on China's AI leap and what it means for Italian SMEs. For detailed technical information on proxies, see Wikipedia.
