Brex Open-Sourced CrabTrap — an AI Agent Firewall That Reveals the Real State of Infosec in 2026

Brex open-sourced something last month that reveals more about the AI security landscape than any white paper I've read this year. It's called CrabTrap, and the name is doing a lot of work.

CrabTrap is an HTTP/HTTPS proxy that sits between AI agents and the outside world, inspecting every outbound request before it leaves your infrastructure. It uses a small, highly optimised local model as a policy judge: should this agent be calling this API? Is this request doing what it says it's doing? Does it violate any security policies? If the answer is no, the request gets blocked before it ever reaches the internet.

Think of it as a firewall for AI agents. Not for blocking things coming in. For stopping things going out.

Brex built it because they're running AI agents that do real work with real credentials — accessing financial systems, querying databases, making API calls. When an agent has production access, a single misrouted request isn't a bug. It's a security incident. The company watched what their agents actually did in production, built policies around the real failure modes they observed, and then open-sourced the tool so everyone else could do the same.

It's a pragmatic, well-engineered response to a genuine problem. But it also reveals something uncomfortable about where we are with AI security.

The AI security arms race is happening on two fronts

Everyone's been focused on the inbound problem: AI crawlers scraping websites, ignoring robots.txt, hoovering up content to train models without permission. And that's a real crisis. Patreon just stopped asking nicely and started actively blocking AI training bots through Cloudflare. Cloudflare recently announced it would block mixed-use AI crawlers by default starting September 2026. There's an entire cottage industry of tarpit tools — Nepenthes, various anti-crawler proxies — designed to trap AI scrapers in infinite loops of fake content.

But CrabTrap addresses the other side of the security equation. The outbound problem. What happens when the AI agents you've deployed inside your own infrastructure start making requests you didn't authorise? What happens when a prompt injection convinces your customer support agent to call an internal admin endpoint? What happens when an agent with database access decides the most efficient way to answer a query is to exfiltrate the entire table?

The inbound problem (AI crawlers scraping you) has gotten the headlines. The outbound problem (your AI agents reaching out) has been quietly accumulating risk while everyone worried about the other direction.

What CrabTrap actually teaches us about AI security

The clever part of CrabTrap isn't the technology. It's the design philosophy. Brex didn't write a static policy document and then enforce it. They deployed agents, watched what the agents actually did in production, built policies around real behaviour, and only then built the enforcement mechanism.

This is the opposite of how most enterprise security works. The typical approach is: write the policy first, then deploy, then discover that the policy doesn't match reality and start issuing waivers. Brex did it backwards — reality first, then policy, then enforcement. The result is a tool that catches the failure modes that actually happen rather than the ones a compliance team imagined might happen.

For no-code builders who are starting to deploy AI agents in client projects, this is the security posture to emulate. Don't write policies in a vacuum. Deploy with monitoring first. Watch what your agents do. Build guardrails around the real risks. Then open-source the tools so the whole ecosystem gets safer.

The problem with DIY agent security

Here's the uncomfortable truth about CrabTrap, though. Deploying it requires running your own HTTP proxy, configuring your own model for policy judgment, and maintaining your own security infrastructure. That's fine if you're Brex, with dedicated security engineering teams and a business model that depends on getting AI agent security right.

For the typical no-code builder — someone building client projects on Bubble, Webflow, or Stacker — standing up a custom AI agent proxy isn't realistic. It's not even the right approach. The right approach is to use platforms that have agent governance built in as infrastructure, not as an afterthought you bolt on yourself.

This is the structural advantage of governed platforms. When you deploy an AI agent through a platform that handles auth, permissions, rate limiting, and API access control at the infrastructure layer, you don't need to become a security engineer to prevent your agent from doing something catastrophic. The platform already has the guardrails.

CrabTrap is a brilliant tool for organisations that run their own agent infrastructure. But the fact that Brex had to build it at all tells you something about the state of the market: agent governance isn't standard yet. The platforms that make it standard — that ship agent security as infrastructure rather than as a DIY project — are the ones that win the enterprise market.

What should no-code builders actually do?

The AI scraping wars and the agent security crisis are two sides of the same coin. Both are about AI systems interacting with infrastructure in ways that violate the owner's intent. The crawler scrapes your content without permission. The compromised agent calls an internal API without authorisation. The underlying security problem is the same: ungoverned access.

For no-code builders, the practical steps are straightforward:

For the inbound side: Use Cloudflare's AI crawler blocking (it's a single toggle for most plans). Add explicit AI bot directives to your robots.txt — not just GPTBot and ClaudeBot, but the full list of known AI crawlers. If you're on a platform like Webflow or Stacker, check whether they handle this at the infrastructure level so you don't have to.

For the outbound side: Audit every AI agent you've deployed. What credentials does it have? What APIs can it call? What would happen if a prompt injection convinced it to do something malicious? If you're using no-code platforms with built-in AI features, understand exactly what permissions those features have and how they're scoped. If you're deploying raw agents through API calls, implement the equivalent of CrabTrap — even if it's just a rate limit and an allowed-endpoints list.

For platform selection: Pick platforms that treat agent governance as a first-class feature, not a configuration option buried in settings. Auth, permissions, API scoping, and audit logging should be on by default, not something you configure after the incident.

The security industry is building the agent governance stack in real time. CrabTrap from Brex. Temporary Accounts for Agents from Cloudflare. AI Control Roadmaps from Google DeepMind. Agent identity infrastructure from NewCore. The pieces are arriving. The question for no-code builders is whether you want to assemble them yourself or use a platform that has already done the assembly.

The takeaway: CrabTrap is a genuinely useful tool from a company that learned agent security the hard way — by watching production agents and building guardrails around what they actually do. But the fact that Brex had to build it themselves is the real story. Agent governance should be infrastructure, not a side project. The platforms that get this right are the ones builders should bet on.