Brex has open sourced CrabTrap, an internal security platform designed to control how autonomous AI agents access APIs, credentials and online services.
The platform was developed as Brex explored how to deploy agent frameworks such as OpenClaw across its operations. The company found that traditional model guardrails and tool permissions were not enough to control agents with access to API keys, OAuth tokens and service accounts.
CrabTrap operates as an HTTP and HTTPS proxy positioned between an agent and every outbound network request. It examines traffic against established policies before deciding whether a request should be approved or blocked.
Users route agent traffic through the platform by configuring their HTTP_PROXY and HTTPS_PROXY environment settings. This allows CrabTrap to work across different programming languages, frameworks and APIs without requiring individual SDK integrations.
The system combines deterministic rules with an AI model that evaluates requests outside known traffic patterns. Brex said the AI judge typically activates for fewer than 3% of requests after an agent has established predictable behavior.
