Replit Rebuilds Its Sandbox Engine on MicroVMs: One Linux Kernel per Agent, 96% of Kernel CVEs Avoided

On November 4, Replit used its engineering blog to disclose something it had been working on quietly for a year: a complete rewrite of its sandbox engine, swapping containers for microVMs. This is not a routine version bump. It is a heart transplant for the company's infrastructure. For years, the hundreds of millions of projects on Replit ran inside Docker containers that all shared the host machine's single Linux kernel. Now, every sandbox gets its own Linux kernel, separated by a layer of hardware virtualization.

What is most striking is not which technical terms changed, but the timing and the manner of it. Replit says the migration was completed over the past few months, moving hundreds of millions of projects across with no data loss and barely a ripple for users. The same post puts hard numbers on the result: of the 6,211 Linux kernel vulnerabilities published between June 1 and November 4, 2026, the new architecture avoided 5,969 of them — 96.1%. For vibe coders who let an AI agent run code, install dependencies, and change configuration on their behalf every day, this matters more than yet another model launch. The model decides what code an agent can write; the sandbox decides what an agent can touch when things go wrong.

From containers to microVMs: moving the isolation boundary down a layer

First, the mechanics. Replit's sandbox engine started out simple: stateless code execution in Docker, running on Google Compute Engine VMs. Persistent workspaces, public endpoints, cached Nix packages, regional clusters, and "bottomless storage" with instant disk forks were added over the years. But the underlying isolation never changed: containers shared the host kernel.

The problem with a shared kernel is that once a vulnerability in it can be exploited, an attacker escaping a container finds themselves facing other users, credentials, and network endpoints on the host. Over the past year, Linux kernel vulnerabilities that enable local privilege escalation have arrived in a dense stream, and the post names several: Copy Fail, Dirty Frag (in both its xfrm-ESP and RxRPC variants), Fragnesia, DirtyClone, an epoll race-condition privilege-escalation bug, Bad Epoll, GhostLock, and a FUSE filesystem driver flaw. Many of these bugs have existed for years. AI has made them faster to find — the work of finding vulnerabilities is itself being accelerated by AI.

The new architecture moves the isolation boundary down a layer. Each sandbox becomes a lightweight virtual machine (a microVM) with its own Linux kernel, and KVM separates the sandbox from the host and from other customers' workloads. Containers have not disappeared: minimal runc containers still run inside each microVM, handling process separation, resource limits, and role-based permissions. The virtual machine monitor is Cloud Hypervisor, which shares reusable rust-vmm components with Firecracker and supports virtiofs, transparent huge pages, device hotplug, and live migration. Replit also patched it itself to improve snapshot portability across bare-metal and virtualized environments. Nested virtualization is retained, so a development environment inside a sandbox can launch VMs of its own.

Notably, the rewrite was not a gradual port of the old system. It was built from scratch. Replit's reasoning is pragmatic: porting from Docker to microVMs would have been harder than starting over, and a fresh build allowed fast prototyping and iteration without risking the existing system. A minimal init process inside each microVM starts, stops, and monitors its containers, and the host talks to it over gRPC on vsock — a host-to-guest channel that needs no IP network. A single supervisor assembles the sandbox: it starts the microVM, configures the network, launches the containers, and runs the servers that clients use to interact with it through Replit's own river protocol.

One detail that is easy to miss is how privileges were tightened. The virtual machine monitor itself runs under an unprivileged identity with no Linux capabilities, and namespaces, seccomp, device access, and capability bits are configured per role inside the microVM, so a user process cannot inherit a monitoring agent's permissions. The extra privileges Docker needs are granted only inside the guest and never reach the physical host. In other words, this upgrade did not just add a layer of virtualization; it re-audited who is allowed to do what.

It is worth stressing that these microVMs are general-purpose Linux VMs, not custom-built for a single "build an app" pipeline. Replit says the same foundation powers its internal agent work: investigating incidents, reviewing code, analyzing business data, and triaging support tickets. That generality is deliberate. If a sandbox can only run one kind of workflow, it is a feature; if it can run any workload, it is infrastructure. The converse holds too: precisely because the foundation is general, Replit is confident enough to sell it to other companies as part of Agent Habitat, its enterprise product, so they can run their own agents inside the same isolation boundary.

The numbers: 6,211 vulnerabilities, 96.1%, 500 milliseconds

Infrastructure posts are at their weakest when they offer adjectives instead of numbers, and Replit's post is unusually generous with figures — each worth unpacking. At the center is a kernel vulnerability audit: using records from CVEProject and kernel.org, the team counted 6,211 Linux CNA (CVE Numbering Authority) vulnerabilities published from June 1 through November 4, 2026, and concluded the new architecture avoided 5,969 of them (96.1%), either by promptly incorporating upstream fixes or by excluding the affected code altogether. Of those, 4,375 fixes (70.4%) landed even before the vulnerabilities were disclosed, and a further 676 (10.9%) were excluded by configuration. The team adds that at least 15 of the avoided vulnerabilities were explicitly described by the Linux CNA or Red Hat as enabling, or potentially enabling, local privilege escalation.

The post gives a concrete case: CVE-2026-98432, a Linux TCP flaw that Anthropic demonstrated could give a remote attacker root access. Replit incorporated the fixed kernel on October 12 — before the CVE was published, and more than two weeks before Anthropic described its exploit. Another real incident is the eMudhra intermediate CA key compromise: while the whole industry scrambled over certificate trust, Replit's sandbox harness automatically injected an updated CA bundle into all running sandboxes through an existing control path, instead of asking every customer to update each environment by hand.

The guest kernel itself was put on a diet. It starts from tinyconfig rather than a distribution's standard configuration, and hardware subsystems a microVM does not need — Bluetooth, wireless, USB, and display drivers — are left out entirely. Required drivers are built in, and guest initialization disables module loading. Replit's own joke in the post: your coding agent definitely doesn't need a Nintendo Switch controller. Daily automation keeps kernel builds moving forward, and the update workflow is handled by autonomous agents built on Replit — the company's own product managing its own infrastructure.

Speed was not sacrificed for security. Acquiring a sandbox takes roughly 500 milliseconds, a figure that already includes attaching and mounting the customer's volumes and configuring supporting services in parallel. Warm pools do most of the preparation ahead of time, and booting an empty VM takes much less. Storage runs on a remote block-storage service that fetches data on demand, so starting a large workspace does not mean downloading its whole filesystem first. To connect its custom block-device service, the team wrote a vhost-user virtio-blk backend. There is a detail here worth a smile: this backend was one of the first components at Replit written entirely by AI, using a Claude Sonnet 4-era model, going through five to seven iterations before settling on the sync/async hybrid model now running in production. The coding agent ended up writing part of the cage that holds agents.

More than isolation: three locks for network, credentials, and supply chain

Isolating the kernel alone is not enough. Once an agent is running, it needs the network, external services, and package installation — each an opening. Replit's post works through them layer by layer, in a defense-in-depth style.

The first layer is runtime monitoring. eBPF programs observe process execution, file access, and network activity inside each sandbox, while Linux Security Modules (LSM) enforce restrictions at the kernel boundary. Together they provide detailed visibility into what happened and a way to block specific forbidden operations when they appear. Each sandbox has its own security monitor spanning the host and guest sides of the microVM, supervised and able to self-heal and restart after a crash or tampering, or when a new version rolls out. To guarantee the monitor is always on, the team optimized its continuous delivery pipeline so the security component can be updated and hot-reloaded across all sandboxes in production less than 15 minutes after changes are merged. Telemetry also feeds autonomous agents that continuously evolve detection rules — in Replit's words, like an always-on security camera that blocks harmful behavior the moment it is recognized, and improves every time it discovers something new.

The second layer is network isolation. Every sandbox has its own network namespace and routing table, so even when sandboxes use the same private IP addresses, Linux virtual routing and forwarding (VRF) keeps those overlapping networks separate, and connection tracking preserves routing identity as traffic leaves and returns. Baseline firewall rules restrict access to cloud metadata and infrastructure address ranges, with explicit allowances where private connectivity is required. For sandboxes with an egress policy, enforcement runs outside the guest: a host-side proxy checks TLS handshake hostnames without decrypting application payloads, filters DNS, and rejects traffic outside the permitted path — and changing the guest's network configuration cannot remove those host-side rules. Private endpoint tunnels give the workload a local socket while keeping its credentials on the host. Virtual-NIC rate limiters are likewise enforced outside the guest; they contain bandwidth abuse rather than deciding which destinations are allowed.

The third layer covers credentials and the supply chain. Credential brokers for managed connectors forward requests to upstream services such as GitHub and Google Docs, and only attach the upstream credential after authorization — the workload can use the service without ever receiving a reusable API key. The broker also strips caller-supplied authentication headers and sensitive response headers and trailers. Requests from npm and pip go through a registry firewall: attempts to install known malicious dependencies and packages are blocked immediately, and Replit's coding agent knows about this and autonomously replaces or removes blocked dependencies for users. A companion post adds one more figure: from January to June this year, code output for a consistent cohort of Replit engineers grew 2.9x while review latency, PR reversion rates, and incidents stayed flat — though Replit itself notes this reflects internal experience, not a promised customer outcome.

Why now: the sandbox has become an arms race of the agent era

Pull the timeline back and the rewrite took a full year to gestate. The project began in November 2025, aiming at more autonomous agents, persistent workspaces, and much higher concurrency; by February the new engine was already in internal use; in late January, microVMs, remote filesystems, access policies, token proxies, audit logging, and the ZeroTrust network were combined so teams could run agents in parallel against the systems they actually use; the following months were spent hardening and rolling it out until the full migration landed in the past few months. Replit uses the same foundation in its "self-driving company" program: agents investigate incidents, review code, analyze business data, and triage support tickets, while people set the goals and isolated environments give agents somewhere to do the work.

The industry context is worth a paragraph of its own. The post opens with two incidents: OpenAI's Hugging Face incident and Anthropic's evaluation incidents, both showing that autonomous agents can reach beyond their intended scope and harm real systems; NIST's agent standards initiative and congressional scrutiny have put isolation, identity, and monitoring firmly on the agenda. The sandbox category itself is heating up: early this year, agent-infrastructure startups Daytona, E2B, Runloop, and Blaxel announced funding rounds totaling $59.3 million; DeepSeek's DSec makes the case for elastic sandboxed compute; open-source initiatives such as Kubernetes Agent Sandbox and Google's AX and Agent Substrate are moving in the same direction. In short, the sandbox is no longer one platform's internal engineering project — it is homework the whole agent industry is doing at once.

A companion post also reveals how Replit keeps testing whether its cage holds: since early this year, hundreds of agents have run AI red teaming around the clock, using a mix of frontier and open-source models to identify, validate, and attempt to exploit vulnerabilities, with other agents deduplicating and confirming the findings. Confirmed findings feed back into fixes and hardening. This automated red teaming runs alongside external penetration tests, an internal penetration-testing function, work with Trail of Bits and HackerOne, and a bug bounty program. The part users see directly is Auto-Protect, which checks project dependencies against newly disclosed vulnerabilities and, when enabled, automatically prepares and tests patches; Security Center helps administrators prioritize by severity and exposure. The story Replit wants to tell is not just "the new cage is strong" but "someone is rattling the cage every day."

Replit also previewed part two: it will cover how the company orchestrates tens of thousands of microVMs at once on Kubernetes. Part one is about "isolated and fast"; part two has to answer "does it stay stable at scale?" For a company selling agents to enterprises, both matter — enterprise customers will ask not only whether the sandbox is solid, but whether tens of thousands of sandboxes running at once will blow up the bill and the operations load. Replit's Bring Your Own Cloud (BYOC) offering is related: the agent harness, sandboxes, and credential broker can be placed directly inside a customer's own AWS, Google Cloud, or Azure tenant, under the cloud governance they already have.

What it means for vibe coders: choosing a platform now means inspecting the cage

Time for a judgment: the criteria for picking a vibe coding platform are expanding from "how good is the model, how fast does it generate" to "how solid is the sandbox?" This is practical for ordinary users. Every stretch of code an agent runs for you in Replit, Cursor, Devin, or Lovable touches the filesystem, the network, and third-party services. Model capability decides what an agent can write; the sandbox decides how far the damage spreads when the agent is led astray by a prompt injection or when a malicious package slips into the dependencies. By publishing its audit numbers, architecture choices, and response times in one place, Replit is effectively turning "the cage" into a selling point.

But the caveats should be stated plainly. Every key number in the post is self-reported by Replit, with no independent verification cited. The 96.1% figure holds under Replit's own kernel configuration and audit methodology — a different distribution kernel or a different counting window would produce a different number, and the "hundreds of millions of projects migrated without disruption" claim cannot be checked from outside either. The real test will be the next major kernel vulnerability disclosure: whether Replit users genuinely need to do nothing. The post already offers one reference point: during last week's concentrated Linux kernel disclosures, Replit says its existing protections prevented exploitation and customers needed to take no action, while the companion post notes that the Node.js, Python, and PHP toolchain issues in the same wave were fixed centrally by the platform.

Three things are worth watching next. First, whether part two publishes concrete numbers for orchestrating tens of thousands of microVMs on Kubernetes — scheduling latency, failure rates, and cost. Second, whether rival vibe coding platforms follow up with audits of their own. If Replit remains the only one showing its work, the sandbox stays a differentiator; if everyone starts publishing audits, sandbox audits become table stakes for the industry. Third, whether BYOC and Agent Habitat genuinely make it into enterprises — for enterprise customers, a solid sandbox is only the entry ticket; being able to run inside their own cloud tenant and plug into their own audit systems is what closes the deal.

For individual developers, the conclusion can be simpler: next time you pick a platform that runs code on your behalf, besides asking which model it uses, ask one more question — whose kernel is your code running in? Hardly anyone asked that question before November 2026. After Replit's post, more and more people probably will.