Replit’s Architecture Behind Secure Agent Work

Last week’s security disclosures offered a glimpse of the challenges ahead. Critical flaws surfaced across software that much of the internet depends on. AI agents are making vulnerabilities faster and easier to find, while the time from discovery to exploitation continues to shrink. Companies increasingly need agents both to defend against threats and to transform how work gets done. As agents take on more responsibility, security must scale with autonomy. Nikesh Arora, CEO of Palo Alto Networks, recently posed a question to every company adopting AI: “There are billions of dollars being spent on coding, is your coding harness secure?” For security leaders, his recommendation is clear: establish guardrails for agent deployments and deploy a second set of eyes to monitor them for drift, compliance, and verifiability. At Replit, we’ve spent years building security into the infrastructure where agents work. When these vulnerabilities surfaced last week, that very foundation enabled us to respond quickly, effectively, and at scale. Our existing isolation protections prevented exploitation of the disclosed kernel vulnerabilities. We went further, patching affected tooling and deploying firewall protections centrally, reducing the remediation work developers would otherwise have had to do themselves. We believe the next step is to automate more of the security response itself, with people defining the policies, approvals, and intervention points that govern the process.