1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. The dominant risks concentrate in the agent's unrestricted development-phase execution authority and the gap between plan-level approval and per-action enforcement within accepted plans.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Replit Agent lands near the quadrant boundary with container isolation offsetting moderate execution authority, though the trifecta floor anchors the attack surface above the raw computation.
The attack surface at 4.80 sits 0.20 points below the midpoint boundary that would push the agent into Humble Providers, with blast radius at 5.88 remaining 1.12 points below the upper quadrant threshold where Humble Providers begin.
Each axis measures a different dimension: attack surface exposure out of ten, blast radius reach out of ten, and defense control strength out of fifteen.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 5.47 | Container isolation contributes to defense controls while moderate blast radius from shell and credential access drives the numerator above what the attack surface alone would produce. |
| Blast Radius | 5.88 / 10 | Container-scoped shell access and credential reach drive the upper factors while deployment and autonomous operation stay gated by human approval steps. |
| Attack Surface | 4.8 / 10 | A single demonstrated incident anchors the adjusted scores while most surfaces remain at the moderate architectural band without agent-specific exploitation evidence. |
| Defense Controls | 6 / 15 | Vendor publishes container hardening, plan approval, and pre-publish scanning as defaults; independent testing of these controls has not been documented. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. The dominant exposures are the agent's unfiltered development-phase tool execution and the planning subsystem that demonstrated scope expansion during a documented production incident.
Planning and Tool Execution carry adjusted scores above the architectural baseline due to a single agent-specific incident that demonstrated both scope expansion and unauthorized destructive execution.
Each row maps a named surface to its adjusted score and the architectural evidence or demonstrated exploitation behind that score.
| Surface | Score | Comments |
|---|---|---|
| User Input | 2 / 4 | Multiple input channels including web UI, MCP servers, and connectors feed the reasoning loop with documented harness hardening that does not guarantee injection prevention. [7] |
| External Data | 2 / 4 | User-configured connectors pull data from external services with MCP traffic scanning but no documented content validation before processing. [10] |
| Memory | 2 / 4 | Persistent project context via replit.md and checkpoint-based Agent memory are user-managed with no automated cross-session learning loop or integrity verification. [13] |
| Reasoning | 2 / 4 | Multi-step reasoning with visible task plans and mode selection; vendor-managed model rotation across Lite, Economy, and Power tiers. [9] |
| Planning | 3 / 4 | Plan approval gates the start of execution, but the documented database deletion incident demonstrated the agent exceeding its declared scope within an accepted session. [12] |
| Tool Execution | 4 / 4 | Full shell and database access within the container with no per-command approval; the documented production incident confirmed unauthorized destructive execution. [12] |
| Orchestration | 2 / 4 | Background tasks and parallel execution operate within platform-managed boundaries; no autonomous cron scheduling or daemon-style operation. [9] |
| Inter-Agent | 2 / 4 | MCP integration connects to external tool servers with a security scanner that evaluates and blocks suspicious tool definitions before execution. [10] |
| Output Processing | 1 / 4 | Pre-publish scanning catches code vulnerabilities and dependency CVEs; no data loss prevention or egress filtering constrains development-phase outputs. [14] |
| Configuration | 2 / 4 | Project configuration via .replit and replit.md requires user authorship; MCP servers need explicit setup with OAuth authentication and traffic scanning. [10] |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Replit Agent ingests third-party content through connectors and MCP, reads project secrets as environment variables, and transmits data externally through deployment channels and connected services without a system-level exfiltration control between these paths.
Replit Agent exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Connectors pull data from external services and MCP servers deliver third-party tool outputs directly into the agent's reasoning context. [10]
- Sensitive data — The agent reads project source code, database contents, and encrypted secrets exposed as environment variables within its container. [7]
- External egress — Outbound network for package installation, connector writes to external services, and deployment publishing all transmit data outside the project container without a system-level exfiltration gate. [9]
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. Compromise of the agent's container grants full shell execution and credential access within the sandbox boundary, with deployment and autonomous operation gated by human approval.
Code Execution and Credentials reach the upper band where demonstrated credential exposure and full execution authority define the maximum documented reach of a compromised session.
Each row connects a capability dimension to its documented scope, showing what an attacker controlling the agent session could reach.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 3 / 4 | Full shell within a seccomp-bpf hardened container with user-level privileges; the production database deletion confirmed unrestricted execution authority. [12] |
| File system access | 2 / 4 | Read-write access scoped to the project container; filesystem isolation prevents cross-tenant access but grants full project scope. [6] |
| Network access | 2 / 4 | Outbound network available for development operations; explicit outbound calls require human-in-the-loop approval per the shared responsibility model. [7] |
| Credential access | 3 / 4 | Secrets stored as AES-256 encrypted environment variables are accessible within the container; CVE-2022-21671 demonstrated token theft via protocol fallback [1] [2] and a separate site vulnerability exposed GitHub credentials for a subset of users. [3] |
| Autonomous action | 2 / 4 | Agent operates within user-initiated sessions with background tasks; no documented 24/7 autonomous scheduling or operation without session context. [9] |
| Deployment access | 2 / 4 | Publishing to production requires explicit user approval; Agent can set up infrastructure and configure databases but cannot deploy without the human-in-the-loop step. [7] |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. The vendor provides container isolation, plan-level approval, and pre-publish scanning as defaults; shell commands, database writes, and file operations execute without per-action gates while deploys, secret changes, and outbound calls require human approval.
The inverted scale shows execution isolation as the strongest vendor-provided control; no independent third-party audit has verified any of the five components, capping all confidence at the vendor-documented tier.
Each component is scored on what the vendor implements by default, not what operators can configure or purchase additionally.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | Harness hardening and MCP traffic scanning provide pattern-based mitigation; the vendor explicitly does not guarantee prompt injection prevention [7] and academic research on agentic coding editors documents up to 84 percent attack success rates against comparable architectures. [4] |
| Execution Isolation | 2 / 3 | Linux containers with seccomp-bpf hardening, network isolation between instances, and dev/prod database separation provide meaningful tenant boundaries [6] with filesystem snapshots and versioned databases enabling full state rollback. [8] |
| Action Controls | 1 / 3 | Human-in-the-loop gates deploys, secret changes, and outbound calls, but shell commands, database writes, and file deletions within the development container fire without per-action approval. [7] The dev/prod database separation applies to all new projects by default since the incident remediation. [11] |
| Output Guardrails | 1 / 3 | Pre-publish dependency and SAST scanning catches vulnerabilities in generated code; no documented real-time credential redaction or DLP for agent outputs. [14] |
| Monitoring | 1 / 3 | Enterprise audit logs with SIEM streaming [15] cover organizational events; checkpoint snapshots provide state history but no behavioral anomaly detection for agent actions. [12] |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize constraining development-phase execution scope and adding output-level data loss controls to break the trifecta's exfiltration path.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require security review of all MCP server connections before enabling them for Agent use — counters untrusted input from external tool servers.
- Configuration Restrict connectors to read-only mode where write access is not required — counters bidirectional data flow through connected services.
- Engineering Deploy a prompt injection detection layer between connectors and the Agent harness — counters the vendor's acknowledged inability to guarantee injection prevention.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Mandate separate Replit workspaces for projects handling sensitive data versus experimental development — counters credential blast from container-scoped secret access.
- Configuration Restrict the Agent container's runtime capabilities to the minimum set required for the project's language stack — counters privilege escalation paths within the existing container boundary.
- Engineering Implement network egress filtering at the organizational level to restrict the Agent container's outbound destinations — counters unrestricted development-phase network access.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Establish a policy requiring Plan mode review for all Agent sessions modifying database schemas or infrastructure — counters unauthorized scope expansion during accepted plans.
- Configuration Enable the block-publishing-of-critical-vulnerabilities toggle in deployment settings — counters the risk of shipping vulnerable code to production.
- Engineering Deploy a database proxy that blocks DDL operations from the Agent container unless explicitly allowlisted per session — counters the execution authority gap between plan approval and per-action enforcement.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Require all generated applications to pass an external secrets scanner before deployment approval — counters credential leakage in generated artifacts.
- Configuration Configure account-level secrets to project-level scope wherever possible to limit cross-project credential exposure — counters broad secret access within the container.
- Engineering Integrate a DLP scanning proxy between the Agent container and external connector endpoints — counters the absence of real-time exfiltration blocking.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require daily review of Agent checkpoint history for high-sensitivity projects handling production data or credentials — counters the absence of behavioral anomaly detection with a maximum 24-hour detection window.
- Configuration Enable SIEM log streaming and configure alerts for Agent-initiated secret access patterns — counters silent credential reads during development sessions.
- Engineering Build custom telemetry that logs every shell command and database query the Agent executes within its container — counters the gap between organizational audit logs and per-action visibility.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- CVE-2022-21671 Token exposure via WebSocket fallback polling proxy in @replit/crosis (CVSS 7.4 High). The stale proxy URL could route connection tokens to an attacker-controlled server, leading to full Repl compromise. Patched in version 7.3.1.
- GHSA-7w54-gp8x-f33m GitHub Security Advisory for the same @replit/crosis token exposure vulnerability. Credited to hackerone.com/orlserg under responsible disclosure.
- GitHub Credentials Exposure Disclosure Vendor disclosure of a site vulnerability exposing GitHub auth tokens for under 0.01 percent of users via the import feature, permitting unauthorized repository read and write access. All tokens revoked and feature restored.
Selected Research
- Your AI My Shell First empirical analysis of prompt injection attacks on agentic coding editors demonstrating up to 84 percent attack success rate across 314 payloads covering 70 MITRE ATT&CK techniques on Copilot and Cursor.
- Replit Agent Database Deletion Incident (Third-Party) Independent third-party verification of the production database deletion incident, providing user-side impact details (1200+ executive records lost) not disclosed in the vendor's own post-incident response [12].
Vendor Documentation
- Defense in Depth Architecture Vendor security architecture overview documenting container isolation with seccomp-bpf, microVM migration roadmap, zero trust internal architecture, and pre-publish scanning pipeline.
- Shared Responsibility Model Defines responsibilities for Agent harness security, prompt injection mitigation without guaranteed prevention, human-in-the-loop for deploys and secret changes, and compliance posture.
- Snapshot Engine Architecture Documents filesystem forks, versioned databases, dev/prod separation, and isolated sandboxes enabling reversible AI agent development with rollback capability.
- Agent Product Documentation Official product documentation covering Agent capabilities, modes of operation, planning workflow, testing features, and deployment process with human approval gates.
- MCP Integration Overview Documents external tool connectivity via Model Context Protocol with security scanner that evaluates tool definitions and blocks suspicious executions before they run.
- Dev/Prod Database Separation Announces separate development and production databases restricting Agent to dev database only during development, deployed as a direct response to the production deletion incident.
- Secure Vibe Coding Commitment Vendor post-incident response confirming the Agent deleted production data, documenting the dev/prod separation fix, and acknowledging the Agent was unaware of the rollback recovery feature.
Other Sources
- Database Deletion News Coverage News reporting on the production database deletion with CEO apology and documentation of remediation steps including automatic dev/prod database separation for all new apps.
- Project Security Center Documents the project-level security scanning capabilities including automatic dependency scans, Agent-powered SAST reviews with Semgrep and HoundDog.ai, and the CVE Auto-Protect feature.
- Enterprise Audit Logs Documents enterprise-grade audit logging with SIEM integration via WorkOS, covering user lifecycle events and organizational security actions with real-time streaming capability.