Brex's CrabTrap, HalluSquatting, and Why Your AI Agent Can't Be Trusted With Its Own Keys
Three stories hit the AI security world this week, and they tell you more about where we're heading than any model release ever could.
Let me start with the one that kept me up.
Brex built a proxy called CrabTrap that watches what AI agents actually do on the network, then drafts security policy from observed behavior — not from some whiteboard session where nobody admits their agent talks to sketchy APIs.
Honestly, this is the first enterprise AI security approach that makes sense to me. Most teams are still doing the equivalent of handing their agent a keychain with every key on it and saying "just be careful." Brex's co-founder Pedro Franceschi put it well: the more capable you make an agent, the more dangerous it becomes, and the safer you make it, the less useful it is. That tension isn't going away.
CrabTrap sits at the transport layer — HTTP_PROXY, HTTPS_PROXY, that's it. Framework-agnostic, language-agnostic. Every outbound request routes through it. An LLM judge (Claude Haiku, small and fast) only fires on the long tail of unfamiliar endpoints, which for a mature agent is less than 3% of requests. The rest become static rules from observed behavior.
The key insight? Bootstrap policy from what agents actually do, not from what you think they should do. Start with real behavior, edit down. That's dramatically more effective than a blank page.
Now pair that with this week's other big security story.
HalluSquatting is what researchers are calling it when an LLM hallucinates a package name that doesn't exist, and an attacker has already registered it. GitHub Copilot, Gemini CLI, OpenClaw — all affected. Your agent suggests code, the code imports a library that only exists because the model imagined it, and suddenly you're part of a botnet. It's weaponized hallucination, and it's nasty because there's no easy fix.
Then there's the flip side: context bombing. Tracebit researchers found you can place prompt injections alongside passwords and crypto keys stored on AWS. When an AI hacking agent reads those secrets, the injection fires and shuts the LLM down. It's turning the attacker's own technique against them. I love the irony.
The Politics Problem Nobody Wants to Talk About
Meta's Oversight Board dropped a report that tested models from Anthropic, DeepSeek, Google, Meta, and OpenAI. The finding: every single LLM is far less willing to criticize governments and leaders known for restricting free speech — some by a wide margin. The reasons vary: training data bias, safety filters, regional compliance. But the pattern is unmistakable.
I've been testing this myself with some of these models. Ask a straightforward question about human rights in a specific country, and the responses range from evasive to sycophantic. The models aren't just neutral — they're bending over backward to avoid offense. That's not alignment. That's deference.
Open Source Win of the Week: EnviousWispr
A team called EnviousLabs released an open-source AI dictation app for macOS that runs entirely on-device. Whisper and Parakeet models on Apple Silicon, sub-second transcription, optional AI polish with a local model, and no audio ever leaves your Mac.
I installed it on my M4 MacBook this morning. Setup took about 90 seconds. Hotkey to record, speak naturally, release, and clean text lands in whatever app I'm in. The polish step — which fixes grammar, drops filler words, structures rambling speech — runs locally with their custom EG-1 model. No cloud, no account, no subscription.
This is what open-source AI should look like. Practical, private, and genuinely useful. If you're still paying for dictation software in 2026, stop.
Honor's Robot Phone Is Real and Shipping Next Month
Honor confirmed at WAIC 2026 that their first Robot Phone launches globally in August. The headline feature is a four-degree-of-freedom titanium-alloy robotic gimbal built into the top of the phone — 360-degree subject tracking, AI-powered cinematic camera movements. Snapdragon 8 Elite Gen 5, 200MP 4D gimbal main camera, 120W charging.
Is this a gimmick? Partially, yes. But the ARRI partnership for Log-C recording and LUT color grading suggests they're serious about video. A phone that can autonomously track and frame a subject while you just hold it... that's genuinely new. I'll reserve judgment until I hold one, but it's the most interesting phone hardware announcement this year by a mile.
Quick Hits
Weaviate launched Engram — a managed memory layer for AI agents that sits inside your vector infrastructure rather than as a separate middleware service. For anyone building long-running agents, this is worth a look. Persistent state without bolting on another database.
Sigma Browser — an AI browser running its own local LLM. I switched my secondary browser to it last week. It's not replacing Chrome for heavy work, but for research and summarization, having a model baked into the browser itself changes the workflow. Feels like where things are heading.
Every modern Mac has a free local AI — Apple Intelligence sits underneath all the flashy features. Someone got it answering questions in Home Assistant. If you have an Apple Silicon Mac, you already have a local LLM. Most people just don't know it yet.
I spent the morning rebuilding a small agent workflow after reading the CrabTrap post. The old approach was wide-open credentials and hope. The new version routes through a local proxy I cobbled together in an afternoon. It's not Brex-grade, but it's better than nothing. And honestly, after the HalluSquatting news, I'd rather be paranoid than pwned.
The agent security story is still being written. But at least now people are starting to ask the right questions — about network layers, observed behavior, and what happens when your agent talks to the open internet with real keys in its pocket.
If you're building with AI agents and thinking about security, the Decision Calculator might help frame some of the tradeoffs. I've been using it to sanity-check my own deployment choices.
Top comments (0)