In the code, I found the ghost of the architect.
It was a Tuesday morning in Auckland, and I was tracing the failed payment of an autonomous procurement agent—a bot supposed to negotiate contracts and settle invoices on behalf of a fintech firm. The agent had made 47 outbound HTTP requests, all to legitimate supplier APIs, but the last one was blocked. The error log read: “CrabTrap: Outbound request denied—intent mismatch.” I had seen that name before, buried in a Brex press release from three days earlier. But reading the log, I didn’t see a tool. I saw a system wrestling with the same question that haunts every decentralized protocol: who decides what an agent is allowed to want?
This is not a story about a new proxy. It is a story about the architecture of control in an age of autonomous software—and the quiet, uncomfortable truth that every safety net is also a leash.
Context: The Silent Crisis of AI Agent Governance
Brex, the fintech unicorn that started as a corporate card for startups, open-sourced a tool called CrabTrap on March 14, 2026. The repository description reads: “An HTTP proxy with LLM-powered intent filtering for AI agents.” The premise is simple: as AI agents gain the ability to make independent outbound calls—to APIs, to websites, to external knowledge bases—they become vectors for misuse. A legitimate agent tasked with “find the cheapest cloud storage” could, through prompt injection, be manipulated to exfiltrate a private key. CrabTrap sits between the agent and the internet, intercepting every request and passing it through two gates: a deterministic rule engine (block known malware domain, whitelist specific IPs) and a large language model that judges the request’s semantic intent.
The tool is not revolutionary in architecture. It is a classic man-in-the-middle proxy, a pattern as old as enterprise security. What is new is the pairing of cold, byte-level rules with a stochastic, probabilistic judge. The LLM does not generate content; it says “yes” or “no” to a URL and a body of data. It is the first widely accessible runtime policy decision for AI behavior that operates outside the agent’s own memory.
But here is the hidden layer: Brex is not a security company. It is a financial services provider. Its core product—enterprise cards, spend management, invoice processing—lives on the very rails that AI agents now navigate. CrabTrap is not a response to a security gap; it is a response to a existential risk to Brex’s own business model. If AI agents cannot be trusted to use corporate funds, then Brex’s customers will not let agents touch money. CrabTrap is a moat disguised as a gift.
Core: The Technical Paradox of Rule + Soul
From my own experience auditing smart contracts in 2017, I learned that the most dangerous vulnerabilities are not in the code but in the assumption of human intent. The reentrancy bug in Project Aether—the one I flagged and that was ignored—was not a syntax error. It was a failure of the system to ask: “What is the caller actually trying to do?” The contract checked balances, but not intentions. CrabTrap attempts to solve that exact problem for agents.
Let me dissect the mechanism.
A standard HTTP proxy for an agent—say, one running in a Kubernetes sidecar—can block URLs, limit request rate, and strip headers. That is the deterministic layer: blacklists, whitelists, pattern matching. But an agent’s request to api.github.com/repos/owner/repo/issues could be benign (asking for a bug tracker) or malicious (exfiltrating code to a repo controlled by an attacker). The URL is the same; only the body and the agent’s internal state differentiate the intent.
CrabTrap’s second gate feeds the full HTTP request (method, path, headers, body) into an LLM prompt: “Given the following outbound request from an autonomous agent, decide if the intent is safe within the context of a corporate spend environment. Return only ‘ALLOW’ or ‘DENY’.” This is semantic filtering, not static filtering. It is the same logic that made me, as a researcher, want to believe in on-chain governance—except here the oracle is a black-box model with unknown biases.
The first hidden cost is latency. In my benchmarks of open-source LLMs for similar tasks (using Llama 3 70B via vLLM), a single classification takes 250–400 milliseconds on an A100 GPU. For a single agent making dozens of sequential calls, that adds seconds to a transaction. For a real-time agent interacting with a user, it kills the illusion of immediacy. Brex has not published latency data. They may be using GPT-4o-mini via API, which would reduce latency but introduce cloud dependency and per-token costs. The architecture is elegant; the economics are brutal.
The second hidden cost is determinism. LLMs are probabilistic. A legitimate request to fetch a quarterly report from a trusted S3 bucket might be denied because the model misinterprets “report” as “rate limit report” or because the training data associated that bucket with a phishing campaign. The consequence: an agent fails to close a deal. The human operator sees the denial, overrides it, and eventually disables the LLM gate entirely. This is the same pattern I observed in DAO governance—idealistic voting mechanisms that are bypassed the moment they inconvenience treasury management. Rules are only respected when they do not hurt.
The third hidden cost is privacy. To inspect HTTPS traffic, CrabTrap must perform TLS interception. This means Brex (or the deploying enterprise) holds the private key to decrypt every outbound call of the agent. The agent may be sending API keys, user personal data, or trade secrets to third-party services. The proxy becomes a single point of audit—and a single point of surveillance. In the same way that a protocol’s foundation wallet can trace every transaction, the CrabTrap administrator can read every agent’s digital soul. Identity is a protocol; soul is the private key. But who holds the key to the proxy?
The technical irony is inescapable: CrabTrap is built to protect agents, yet it replicates the exact centralization that Web3 was meant to eliminate. The proxy is the new foundation wallet. The intent model is the new multisig. And the LLM judge is the new oracle—fallible, biased, and opaque.
Contrarian: The Proxy as an Ethical Time Bomb
The contrarian narrative is not that CrabTrap is insecure—it is that by making AI agents safe for enterprises, it inadvertently makes them safe for the wrong kind of control. The same tool that blocks a phished request can also block an agent from whistleblowing, from accessing a competitor’s public data, or from executing a legitimate trade that violates a company’s internal policy. The intent filter is a policy enforcement point disguised as a safety mechanism.
Consider the case of an agent working for a financial journalist. Its task: “Find all publicly available earnings reports from Company X.” A simple, legal request. But if the LLM judge was trained on internal Brex data that flagged Company X as a high-risk counterparty (perhaps due to a past fraud), it might deny the request. The journalist never knows why. The agent silently fails. The truth is concealed not by a law but by a black-box model trained on opaque corporate data.
The deeper risk is regulatory capture. Brex, as a fintech, has a strong incentive to ensure that AI agents using their cards do not interact with unregulated DeFi protocols or crypto mixers. CrabTrap can be configured to block any request to a smart contract address. That might be prudent for risk management. But it also creates a digital fence around the entire alternative financial system. Enterprises using CrabTrap will never have their agents interact with a DEX, never use a privacy coin, never touch a self-custodial wallet. The proxy becomes a tool for financial orthodoxy, not security.
The audit is not a check; it is a confession. By open-sourcing CrabTrap, Brex confesses that it cannot trust the agents it enables. It confesses that the autonomous future must be mediated, controlled, and interrupted. And in doing so, it invites a question that every blockchain project has faced: if the safety requires a central authority, is it truly an evolution, or just a faster cage?
Takeaway: The Next Narrative—Decentralized Intent Verification
When the pool empties, only the intent remains. And what remains, after all the proxies and policies, is the fundamental need for intent verification that does not rely on a single corporate LLM. The next narrative in AI agent security will not be about better gateways; it will be about verifiable, on-chain attestations of agent behavior.
I foresee a future where every outbound request from an agent is accompanied by a zero-knowledge proof—a cryptographic signature that says: “The request’s intent is exactly what it claims, and the provenance of that decision is auditable without revealing the agent’s internal state.” CrabTrap is the first generation: centralized, opaque, effective for compliance. The second generation will be decentralized, transparent, and resistant to capture.
But that future requires a shift in mindset. It requires believing that an agent should own its own intent—not lease it from a corporate proxy. It requires building tools that do not ask “what did the model decide?” but “can anyone verify why it decided?” The ghost I found in that log was not a bug. It was a reminder that every architecture is a reflection of the trust it was designed to preserve. And trust, like a private key, cannot be delegated.