The current gold rush in generative AI has shifted from chatbots that talk to agents that act. Developers are no longer satisfied with a window that returns text; they want entities that can navigate a file system, call APIs, and manage workflows autonomously. However, this ambition hits a hard ceiling the moment an agent is given the power to execute code. The industry has largely responded by building tighter sandboxes or limiting the available toolsets, effectively neutering the agent's autonomy to ensure the company's data doesn't vanish into a random external endpoint. This tension between capability and safety has created a bottleneck where agents are either too restricted to be useful or too dangerous to deploy.
The Architecture of the Virtual Employee
Brex is attempting to break this deadlock with the introduction of OpenClaw and its accompanying security layer, CrabTrap. Launched in January 2024, OpenClaw represents a departure from the standard agentic framework. While most agents rely on a static set of predefined tools provided by the developer, OpenClaw is designed for self-bootstrapping. This means the agent does not just use tools; it builds, maintains, and iterates upon its own codebase to solve problems. By granting the AI the ability to write its own functional logic, Brex has moved beyond the chatbot paradigm to create virtual employees. These entities are integrated into the corporate fabric, possessing their own Slack accounts and email addresses, and are capable of participating in meetings as active contributors.
To support this level of autonomy without risking a catastrophic security breach, Brex developed CrabTrap. Rather than attempting to police the code the agent writes—which is an almost impossible task given the fluidity of self-bootstrapping—CrabTrap operates as an open-source HTTP proxy. It sits as a sentinel between the agent's container and the open internet, monitoring every single piece of outbound HTTP traffic. The fundamental philosophy of CrabTrap is a zero-trust approach: it assumes the agent is already compromised or may attempt an unauthorized action, and therefore focuses entirely on the data leaving the system rather than the process generating it.
Shifting the Perimeter from Tools to Traffic
The critical insight behind CrabTrap is the realization that restricting tools is a losing game. When an agent can write its own code, it can potentially find ways to bypass tool-level restrictions or create new pathways to the internet. Brex recognized that the only immutable point of control is the network layer. By shifting the security perimeter from the agent's internal logic to the outbound network traffic, Brex allows the agent to maintain full coding power while ensuring that no data leaves the environment without authorization.
Implementing this at scale introduces a significant latency problem. If every single network request had to be analyzed by a Large Language Model to determine if it violated security policy, the agent would grind to a halt, adding thousands of milliseconds to every operation. To solve this, Brex implemented a bifurcated system. The traffic is split into two streams: low-risk and high-risk. Routine tasks, such as a recruiting agent fetching a public LinkedIn profile, are handled by static rules that allow for near-instantaneous passage. Only high-risk actions, such as sending an email or accessing a sensitive API, are routed to the LLM Judge.
This architectural choice ensures that only about 2% of all requests incur the latency of an LLM evaluation. The LLM Judge does not require complex, exhaustive prompting to function; instead, it leverages the semantic understanding of HTTP request patterns it acquired during its pre-training on vast amounts of web data. When the judge detects a policy violation, it doesn't just block the request—it triggers a human-in-the-loop workflow. An alert is sent via Slack to a human administrator, who can see the agent's intent and the proposed action. The administrator can then approve the request or update the security policy in real-time with a simple click, effectively training the security layer through active supervision.
Brex's decision to build this in-house was a calculated risk. The company admitted that there was a 70% probability that a commercial security product would supersede CrabTrap within six months. However, the strategic value of defining their own AI deployment architecture outweighed the risk of redundant effort. This is exemplified in their deployment of Jim, a virtual recruiter. Jim handles candidate sourcing, applicant scoring, and email outreach. When Jim attempts an action that falls outside his current policy, CrabTrap escalates the issue to a manager. This mirrors the traditional corporate hierarchy where a junior employee seeks approval from a supervisor before taking a high-stakes action, translating a human organizational model into a technical security architecture.
For developers looking to maximize agent productivity, the lesson is clear: stop trying to build a perfect sandbox and start building a smarter gate. Moving security to the network proxy layer allows for the preservation of the agent's most powerful capability—the ability to execute and iterate on code—while maintaining a hard line of defense at the edge of the network.
