Brex Builds AI Agent Security Tool That Learns From Real Actions

Brex, a financial technology company, has created an open-source tool called CrabTrap to manage how artificial intelligence agents access company systems. Instead of writing strict rules first, Brex's approach watches what agents actually do and creates policies from that behavior. CrabTrap works as a proxy that sits between AI agents and the internet. Every outbound request from an agent goes through CrabTrap, which checks if the request is allowed. For most requests, simple rules apply. For unusual ones, a small AI model called an LLM-as-a-judge decides. This method reduces security risks because agents need real credentials like API keys to work. Traditional guardrails often block useful actions or are easy to bypass. By learning from real traffic, CrabTrap creates policies that match what agents actually need. The tool has increased confidence at Brex. Teams now deploy autonomous agents more widely because they trust the enforcement layer. The audit trail also showed agents make many unnecessary requests, helping teams tighten agent tools and save time. CrabTrap is open-source and has gained over 700 stars on GitHub. Brex hopes the community will help improve features like better authentication and automatic policy updates. "Don't let infrastructure gaps become excuses to wait," said Brex CEO Pedro Franceschi. "You can own those problems directly."