Fintech giant Brex open-sourced a tool called CrabTrap this week. A humble HTTP proxy, they claim, designed to filter outbound traffic for AI agents. The announcement landed with the quiet thud of a corporate blog post, not the roar of a product launch. Yet in the sparse details, a deeper story emerges — one about the uncomfortable truth that AI agents, the darlings of 2025, are fundamentally vulnerable to the same old internet they are learning to navigate.
Context: Brex and the AI Agent Gambit
Brex, a corporate card and expense management platform, is not a security company. It is a B2B fintech. Its core business is issuing cards and processing payments for startups and scale-ups. In 2024, Brex began aggressively marketing its services to AI-native companies — those building autonomous agents for procurement, coding, or customer support. These agents need to call external APIs, scrape websites, and execute financial transactions. The risk is obvious: an agent could be hijacked via prompt injection to send money to an attacker, or leak sensitive data. CrabTrap is a response to this risk.
Watch the flow, not the flood. CrabTrap sits as a man-in-the-middle HTTP proxy, intercepting every outbound request from an AI agent. It then applies two layers of filtering: a deterministic rules engine (think URL allowlists, domain blocklists) and a large language model (LLM) that attempts to judge the intent of the request. If the LLM deems a request malicious or out-of-policy, the request is blocked. On paper, it is a straightforward combination of old-school web security and new-school AI reasoning.
Core: The Technical Reality — A Proxy’s Hidden Burden
Based on my experience analyzing early-stage fintech security tools during the 2017 ICO boom, I see a pattern repeated here. The architecture is not novel. It is a standard forward proxy with a custom decision engine. The real engineering challenge is not the concept — it is the cost of that LLM judgment. Every single outbound call from an agent now requires an LLM inference. For an agent that makes hundreds of API calls per minute, latency becomes crippling. In a financial transaction, a 2-second delay on a payment authorization is unacceptable. CrabTrap does not disclose its P99 latency.
Furthermore, to inspect HTTPS traffic — which constitutes 95% of modern web traffic — CrabTrap must perform TLS interception. This means decrypting all traffic, inspecting it, re-encrypting it. This is legally fraught in jurisdictions with strict privacy laws (GDPR, CCPA). Brex’s documentation is silent on how it handles data residency, consent, or audit logging. In my own audits of similar tools, the TLS decryption layer often becomes a massive compliance blind spot.
Code is law until it isn’t. The LLM itself introduces a second-order problem: false positives. An agent that issues a legitimate purchase order to a new vendor might be blocked because the LLM misreads the intent. For a fintech, a false positive can mean a lost deal, a frustrated customer, or a missed payment deadline. The tool’s risk calibration is entirely opaque.
Contrarian: This Is Not a Product — It’s a Land Grab
Here is the contrarian angle most coverage misses: CrabTrap is not meant to be a best-in-class security product. It is a strategic asset to define the conversation around AI agent security. By open-sourcing a reference implementation, Brex positions itself as the thought leader in a nascent space. It creates a de facto standard that other agents must integrate with, or at least consider. It is the same playbook used by early API management platforms: open-source the spec, then sell the enterprise version.
But the real blind spot is that Brex is not addressing the core threat: prompt injection and tool hallucination. CrabTrap only controls network egress. It cannot prevent an agent from being poisoned at the input layer. Regulation chases shadows. The industry is obsessed with building walls around agents, but the agents themselves are compromised before they even make a call.
Takeaway: The New Perimeter Begins with Humility
CrabTrap is a signal, not a solution. It tells us that the industry has finally accepted that AI agents need guardrails — but it also reveals how immature those guardrails are. The tool’s success will not be measured by GitHub stars, but by whether it inspires a new generation of security standards that go beyond simple proxies. The real question is not whether CrabTrap can block malicious requests. The question is whether we are willing to slow down our agents’ autonomy in exchange for safety. That trade-off has no open-source answer yet.