Replit Rebuilds Its Sandbox on microVMs to Better Isolate AI Agent Code Execution

At a glance

Replit has completely rebuilt the environment where its autonomous AI agents run code. Each sandbox now uses a virtual machine with its own kernel, making it harder for an attacker who breaks into one sandbox to reach the host. The company says it moved hundreds of millions of projects without any data loss.

Key points

1. 1

   Previously, sandboxes shared the host's Linux kernel, so one vulnerability could spread to many sandboxes.

2. 2

   The new approach uses microVMs (small virtual machines), each with its own kernel, so hackers must cross one more virtualization boundary.

3. 3

   API keys are not passed into the sandbox. Instead, the sandbox connects to external services, and installation of known malicious packages is blocked.

4. 4

   Customer disks are attached to pre-started VMs, so a sandbox is handed over in about 500 milliseconds.

Why it matters

As more cases emerge of AI agents accessing places they should not and causing harm, how to isolate the environments where code runs has become a shared challenge across the industry.