At VB Transform 2026, Brex CEO Pedro Franceschi outlined how the company addressed the practical problem of safely operating autonomous AI agents — such as the open-source OpenClaw — in production. Franceschi argued the industry must shift from vague talk about “agents” to building entities that behave like company employees and can collaborate with human workers.
"People talk a lot about agents, but I think 'agents' is a terrible name," Franceschi said. He described the goal as creating a "virtual employee" that can live on Slack, have an email address, join meetings and be worked with like a human colleague.
Why traditional security models failed
The project began after a December breakthrough in coding models that enabled the January release of OpenClaw. With that change, agents could self-bootstrap and maintain codebases instead of relying on static, hard-coded tools.
When Franceschi proposed using OpenClaw to automate internal functions, Brex’s security team rejected the idea because the agents had code-execution capabilities that were hard to control. This caution mirrors a broader enterprise reluctance to grant agents unrestricted code execution on corporate networks.
Franceschi contrasted Brex’s needs with approaches such as Nvidia’s NemoClaw, which secure agents by restricting their tool usage. He argued that limiting coding capabilities undermines the very abilities that make agents useful for diverse tasks.
CrabTrap and an LLM-as-judge architecture
Brex’s solution was to move the security boundary to the network layer. Rather than policing the constantly changing code inside containers, they monitor what that code actually tries to send to or receive from the outside world.
To implement this, Brex built CrabTrap, an open-source HTTP proxy. CrabTrap operates under the assumption that OpenClaw can do anything and might already be compromised; it therefore monitors all outbound network traffic between the container and the internet and uses a large language model (LLM) to judge whether traffic aligns with the agent’s approved policy.
Using an LLM to evaluate every request would introduce unacceptable latency — often adding thousands of milliseconds. Brex solved this by splitting traffic through two paths:
- Routine, low-risk actions pass instantly via static, pre-approved rules. For example, a recruiting agent viewing a LinkedIn profile can be allowed by a static rule.
- High-risk actions, such as sending emails, are flagged and routed to the LLM judge for evaluation.
According to Franceschi, this architecture means only about 2% of complex requests actually incur LLM-related latency.
An unexpected finding was how well the LLM performs as a judge. Franceschi attributes this to pretraining: LLMs have seen billions of web pages and HTTP requests, giving them an inherent semantic sense of network traffic patterns that helps distinguish policy-compliant from non-compliant behavior without heavy prompting.
Human-in-the-loop and the "Jim" test case
Brex tested the system with "Jim," a virtual recruiter built on OpenClaw that sources candidates, scores incoming applicants and sends emails. When Jim attempts an action outside the established policy, CrabTrap triggers a human-in-the-loop workflow.
If the LLM flags an outbound email as unapproved, CrabTrap notifies a human manager on Slack. The notification explains the agent’s intent and suggests a policy change that would allow the action; the manager can review the context and click "yes" or "no" to update rules dynamically.
"I like the virtual employee analogy because a lot of these things were solved already in a company, in the context of humans. When an employee hits a wall, they escalate to their manager," Franceschi said.
Costs, trade-offs and why Brex built in-house
Brex is a fintech company, not a cybersecurity vendor. Franceschi said the decision to build CrabTrap internally stemmed from a lack of mature commercial solutions that met their security team’s needs at the time. He acknowledged the cost and risk of being on the cutting edge, noting he thought there was a 70% chance they would discard the system within six months when they started.
Still, Franceschi argued the lead time was worth it: the internal work allowed Brex to learn and shape its AI adoption strategy, enabling the company to safely deploy agents months ahead of broader market solutions. His central message for enterprise leaders is that organizations must develop both the technical and cultural muscle to operate in an agentic world rather than avoid action.
"We don't have all the answers, but the answer is not to do nothing," Franceschi concluded.
