Replit 安全 Agent 工作架構：Agent Habitat 的安全與治理設計

Last week’s security disclosures offered a glimpse of the challenges ahead. Critical flaws surfaced across software that much of the internet depends on. AI agents are making vulnerabilities faster and easier to find, while the time from discovery to exploitation continues to shrink.

Companies increasingly need agents both to defend against threats and to transform how work gets done. As agents take on more responsibility, security must scale with autonomy.

Nikesh Arora, CEO of Palo Alto Networks, recently posed a question to every company adopting AI: “There are billions of dollars being spent on coding, is your coding harness secure?” For security leaders, his recommendation is clear: establish guardrails for agent deployments and deploy a second set of eyes to monitor them for drift, compliance, and verifiability.

At Replit, we’ve spent years building security into the infrastructure where agents work. When these vulnerabilities surfaced last week, that very foundation enabled us to respond quickly, effectively, and at scale. Our existing isolation protections prevented exploitation of the disclosed kernel vulnerabilities. We went further, patching affected tooling and deploying firewall protections centrally, reducing the remediation work developers would otherwise have had to do themselves.

We believe the next step is to automate more of the security response itself, with people defining the policies, approvals, and intervention points that govern the process.

As part of our Self-Driving Company blueprint, we’re bringing this infrastructure and these capabilities to other companies through Replit’s Agent Habitat. An Agent Habitat gives agents access to company knowledge and systems within boundaries the company controls, helping them delegate more work to agents without giving up control over how the work gets done.

Security and governance for the self-driving company

Becoming self-driving requires safeguards that let companies delegate work while remaining in control. Four principles guide how we build those controls in Replit’s Agent Habitat:

1. Give agents only the authority they need. Control what agents can access, which actions require approval, and how permissions carry through delegation.
2. Contain failures and respond to vulnerabilities. Isolate execution, protect credentials, and respond to vulnerabilities in the environment where work happens.
3. Expand access while keeping production changes accountable. Enable people to contribute while keeping production decisions subject to engineering review.
4. Keep delegated work accountable and data governable. Make agent activity visible, support investigations, and establish clear boundaries for data and workloads.

Below, we take a closer look at these principles and how Replit puts them into practice.

“Our customers trust Teamworks with sensitive athlete health and performance data, so security and governance are non-negotiable. We chose Replit to help more people across our business improve our software while maintaining the security controls and engineering oversight we need.”

~ Reed Shaffner, Teamworks CTO

1. Give agents only the authority they need

Connecting an agent to a business system gives it authority. If a task only requires reading but the connection also permits writing, a mistake or prompt injection can have consequences beyond the task itself. Limiting access to what the work requires helps reduce that risk.

Replit’s enterprise connector management lets administrators control which groups can use each connection and define scopes for custom OAuth connectors. SAML SSO, SCIM provisioning, and role-based permissions let companies centrally manage who can build, collaborate, and ship, synchronized with their identity provider.

Credentials need a separate, stricter boundary. An agent should be able to make an authorized request without gaining access to the reusable external credential behind it. Replit keeps connector credentials outside the agent’s context. A credential broker authorizes every single request, and only retrieves the credentials from a vault and adds them to outgoing requests after that request is authorized. This reduces the risk of secrets being exposed through generated code, logs, or conversations, as well as giving finer-grained access control beyond OAuth scopes.

These controls address different risks. Permissions determine what an agent is authorized to do, while credential protection helps prevent reusable secrets from being exposed. Enterprises also need to govern how agents use the data they access, including which actions they can take with it. Together, these controls let enterprises connect agents to the systems their work requires without giving them unrestricted access to company accounts or reusable credentials.

2. Contain failures and respond to vulnerabilities

An agent experimenting with code should not automatically gain access to an employee’s laptop, a production database, or unrelated workloads. If an agent or the code it runs is compromised, isolation helps limit what that failure can affect.

Replit provides isolation and containment at every layer of the stack, so agents can do their best work without the risk. Based on our shared responsibility model, we are responsible for securing the harness, the runtime, and the operating system. Agents run in isolated cloud environments. MicroVMs give each execution environment its own minimal kernel, strengthening isolation between workloads. For apps using Replit’s managed databases, development and production databases are kept separate. Connector permissions provide another boundary for external systems.

This architecture mattered during this week’s Linux kernel disclosures. Replit’s existing microVM architecture with a hardened kernel configuration prevented exploitation of the Linux kernel vulnerabilities. Customers did not need to take action for those vulnerabilities. The protection came from an architectural decision made before the disclosures.

Isolation alone cannot prevent every vulnerability and protection must continue after software ships. Newly disclosed flaws in dependencies and runtimes can create urgent remediation work even when an application’s own code has not changed.

When vulnerabilities were found in Node.js, Python, and PHP tooling, Replit patched the versions used on our platform and made patched versions available to users. We also deployed web application firewall rules to block applicable exploits. Where apps needed to be republished to pick up the patches, users were notified.

Customers also need to know what remains vulnerable. Auto-Protect checks project dependencies against newly disclosed vulnerabilities and, when enabled, automatically prepares and tests patches for matching issues. Security Center helps administrators identify affected projects and prioritize remediation based on severity and exposure.

Together, these protections reduce both the impact of a failure and the work required to respond. Isolation limits what a compromised workload can affect. Platform-level fixes and vulnerability tooling help teams identify and address what remains at risk.

We also continuously test Replit itself.

Since early this year, we’ve run AI red teaming around the clock, with hundreds of agents using a combination of frontier and open-source models collaborating by identifying, validating, and attempting to exploit vulnerabilities. This complements external penetration tests, our internal penetration-testing function, work with Trail of Bits and HackerOne, and our bug bounty program. Combining automated testing with independent assessments and human expertise helps us find weaknesses as the platform evolves. These protections are part of Replit’s broader defense-in-depth approach, which we describe in Defense in Depth.

3. Expand access while keeping production changes accountable

Agents can help people closest to a problem improve the software they use, even when they are not engineers. But proposing a change and approving it for production must remain distinct.

Replit lets subject-matter experts make targeted changes to the company codebase using agents and submit pull requests. Agents prepare changes in a separate branch of the existing repository. Engineers can review the code, inspect it in a running sandbox, and use screenshots or videos where helpful. Agents can then address feedback and failing checks within the existing review workflow.

For apps built in Replit, security review combines automated scanning with AI analysis. Our research on securing AI-generated code found that functionally equivalent code could receive different AI-only security assessments depending on syntax or prompt phrasing. Dependency-level vulnerabilities also required traditional scanning infrastructure. For enterprises, this inconsistency makes AI-only security checks difficult to rely on as a consistent baseline.

For these apps, our Security Agent combines static analysis, dependency scanning, and AI reasoning. Repeatable checks for known vulnerabilities complement model analysis of code context and business logic. Teams can also run black-box penetration tests against a running copy of an app, testing it from an external attacker’s perspective without access to its source code.

Private deployments enforce app access at the platform level, rather than relying solely on agent-generated code to implement access restrictions. Under our shared responsibility model, app owners remain responsible for reviewing and approving what goes to production.

Keeping contributions separate from production approval makes broader participation practical. More people can propose and iterate on changes while engineering review and security checks remain in place.

We’ve applied the same principle internally. In Replit’s Self-Driving Company, we established access policies, token proxies, audit logging, and a Zero Trust network. From early January to late June, code output for a consistent cohort of engineers grew 2.9×, while review latency, PR reversion rates, and incidents remained flat.

These results reflect our internal experience, not a promised customer outcome. They illustrate the goal: enabling more contributions without giving up engineering review or reliability.

4. Keep delegated work accountable and data governable

Accountability requires a clear record of what happened. As agent adoption expands, administrators need to understand how teams use Replit, identify security-relevant activity, and reconstruct what happened during an investigation. Replit’s enterprise governance tools provide visibility into organizational usage, while audit logs capture security-relevant events across agent activity, connectors, secrets, deployments, and access changes.

Administrators can search, filter, and export records, or stream them to security information and event management (SIEM) tools such as Datadog or Splunk for monitoring and investigation. This visibility helps security teams investigate unexpected behavior, understand which systems were involved, and bring agent activity into their existing monitoring and incident-response processes.

Governing delegated work also means understanding how its data is protected and where its workloads run. Replit encrypts hosted data in transit using TLS 1.2+ and at rest using AES-256, including databases, Object Storage, and stored secrets with an option to use a Customer Managed Encryption Key (CMEK) for single-tenant enterprise customers.

For maximum control, Bring Your Own Cloud (BYOC) puts the agent harness, sandboxes, and credential broker in a company’s cloud tenant, under its existing cloud and network governance. For teams that don’t need BYOC, Project geography still gives them control over where published compute, databases, and Object Storage are hosted.

Neither option determines how every external service or model provider processes data. Enterprises evaluating a workflow end to end need to understand those separate boundaries, too.

Together, auditability and clear data boundaries help enterprises evaluate whether agent-driven workflows meet their security, operational, and governance requirements.

Security that scales with autonomy

Today, Replit’s Agent Habitat provides controls at the organization, connection, and execution-environment levels. As agents take on more consequential work, those protections need to evolve: finer-grained permissions for each task, security review across more code workflows, and stronger detection and response while agents run.

• We’re developing an extensible agent-action policy system with organization-wide limits that can be narrowed for individual tasks. Specialized agents should receive only the permissions their work requires, and delegation should not expand those permissions. Enforcement must also hold during background and scheduled work.
• We’re expanding Security Agent to company codebase contributions, helping teams find and address vulnerabilities before changes reach production.
• We’re planning new controls built on our existing eBPF-based sandbox monitoring to detect and respond to suspicious agent activity, such as unexpected file access or network connections.

Security for agent systems is still evolving. Our Sandbox Architecture white paper is our north star, and it sets out verifiable security requirements and a framework for measuring progress. We’ll continue sharing what we learn and engaging with the broader industry as these practices develop.

Last week’s disclosures showed how quickly the window between discovery and exploitation is closing. Agents will take on more consequential work whether or not governance is ready, so the time to set those boundaries is before that work is delegated, not after. Security has to scale with autonomy so teams can delegate more without giving up control. We’re committed to strengthening Replit’s Agent Habitat so companies can become self-driving, giving agents greater autonomy while retaining control over how work gets done.

For more, review our security controls and compliance documentation in the Replit Trust Center