Brex open-sources CrabTrap, a proxy that polices AI agents before they go rogue with your API keys

AI agents are great at getting things done. They’re also great at doing things nobody asked them to do, especially when you hand them real credentials and tell them to figure it out. Brex, the fintech platform that has been steadily weaving stablecoin payments into its product stack, decided the solution wasn’t better prompts. It was a network-level choke point.

The company open-sourced CrabTrap on April 21, 2026, releasing the tool via its engineering blog and GitHub. It’s an HTTP/HTTPS forward proxy that sits between AI agents and the outside world, intercepting all outbound network traffic and deciding, request by request, whether to let it through.

How CrabTrap actually works

The proxy uses a two-tier evaluation system. First, it runs deterministic static policy rules, the kind of hard-coded logic that says “never send credentials to an unauthorized domain” or “block any request that tries to modify billing records.” These are fast, predictable, and handle the bulk of traffic.

When a request falls into a gray area that static rules can’t cleanly resolve, CrabTrap escalates to what Brex calls an LLM-as-a-judge. A large language model evaluates the request against customizable natural language policies and makes a contextual decision about whether to approve or deny it.

On mature, well-established agents in production, Brex reports that the LLM judge gets invoked on less than 3% of requests. The deterministic rules handle everything else. That means the system isn’t burning compute on expensive model inference for every single API call, only for the genuinely ambiguous ones.

CrabTrap operates at the transport layer, which makes it agent-framework agnostic. If traffic leaves the machine, CrabTrap sees it. Every request and response gets logged for auditing and policy refinement.

Why this matters for fintech and crypto

Brex isn’t just any fintech company building developer tools. Since September 2025, it has been processing crypto payments using USDC, positioning itself as a bridge between traditional corporate finance and digital assets. That makes CrabTrap more than an engineering curiosity. It’s infrastructure being battle-tested in an environment where stablecoins are actively flowing.

AI agents operating in financial services need access to sensitive credentials to do anything useful, whether that’s reconciling payments, managing treasury operations, or interacting with blockchain-based settlement systems. The risk profile gets exponentially worse when those agents can hallucinate actions or fall victim to prompt injection attacks, two well-documented failure modes in agentic AI systems.

Brex building this internally and then open-sourcing it sends a signal to the broader market. That Brex is deploying CrabTrap within its own corporate environment, where real money and real stablecoin transactions are at play, adds credibility that a research paper alone wouldn’t provide.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.