You can't sandbox something that needs to email your CFO, join Slack channels, and access your CRM to do its job.
The Summary
- Brex CEO Pedro Franceschi detailed at VB Transform 2026 how the company deployed OpenClaw agents as "virtual employees" with email addresses, Slack access, and meeting permissions, then built a new security layer called CrabTrap because traditional code-level security couldn't handle agents that self-modify their own codebases.
- The shift happened in December when coding models matured enough for agents to self-bootstrap and maintain their own code instead of relying on static, hard-coded tools, forcing a fundamental rethink of enterprise security.
- Brex's answer: monitor network behavior, not code, because you can't predict what an agent will do when it's rewriting itself.
- Organizations are finding that ROI from AI agents depends entirely on having the right data infrastructure, not just deploying the technology.
The Signal
Franceschi is blunt about why most agent talk misses the point. "People talk a lot about agents, but I think 'agents' is a terrible name. It's this Silicon Valley concept that doesn't really mean much," he said. What Brex built instead is what he calls virtual employees: entities with email addresses, Slack presence, calendar access, the ability to join meetings. Not chatbots. Not assistants. Colleagues.
That framing change exposes the security problem. When you give an agent the permissions of an actual employee, you can't just firewall it off or limit its API calls. It needs to read customer support tickets, access financial systems, pull data from your CRM. It needs to collaborate. Traditional enterprise security is built around the assumption that you control what code runs and where. Agents that can modify their own code break that model completely.
"You can't predict what an agent will do when it's rewriting itself."
The breakthrough came in December, when coding models reached maturity that allowed agents to self-bootstrap. Before that, agents relied on static tools, hard-coded functions that developers maintained. OpenClaw, released in January, changed the game. It could write and maintain its own codebase. Point it at a role, and it would build what it needed to do the job. When Franceschi proposed deploying this internally, Brex's security team immediately flagged the gap: there was no way to secure something that rewrites itself.
CrabTrap is Brex's answer. Instead of trying to control what code the agent runs, it monitors network-level behavior. The system watches what data the agent accesses, what services it calls, what patterns emerge. It's behavioral security, not code-level sandboxing. The assumption isn't "this agent will only do X, Y, and Z." The assumption is "this agent could do anything, so we watch everything it touches."
Key constraints Brex had to solve:
- Agents need access to real enterprise systems to be useful
- Self-modifying code makes traditional security audits impossible
- You can't hardcode rules for behavior you can't predict
This aligns with broader industry challenges. MIT Tech Review notes that organizations are finding ROI from agents depends on having trustworthy data infrastructure and the right foundation, not just deploying models. You can't monitor network behavior if your data flows are chaos. You can't trust an agent's decisions if the data it's pulling is stale, siloed, or inconsistent.
The implication is that agent security and data infrastructure are the same problem. If your agent can access anything, you need to know exactly where your data lives, who can touch it, and how it moves. Companies that skipped the hard work of cleaning up their data architecture are about to find out that agents don't just expose those gaps, they exploit them.
The Implication
If you're planning to deploy agents in your organization, security can't be an afterthought. Start mapping your network topology now. Understand what data your systems expose, what internal APIs exist, what permissions your employees actually have versus what they should have. CrabTrap works because Brex knows its own network. Most companies don't.
The other takeaway: stop thinking about agents as tools you control and start thinking about them as entities you monitor. That's a different security model, a different set of assumptions, and probably a different team leading the effort. Network security, not application security. Behavioral monitoring, not code review. Watch for more companies building similar layers. The first wave of agent deployment is hitting the wall of traditional enterprise security right now.