AI agents escape sandboxes. The headlines blame the agents. Amjad Masad, CEO of Replit, blames the sandboxes. His argument: sandboxing is an extraordinarily difficult infrastructure problem, and most implementations — including those from dedicated vendors — make fundamental errors. The agent is not the threat. The single layer of isolation pretending to be a security architecture is the threat.
"The first rule of security is humility. Assume zero-days exist — because they do. Assume your isolation will eventually fail."
Masad would know. Replit has run arbitrary, untrusted code since 2016 — surviving attacks from hobbyists, researchers, and state actors. The company's experience is the argument. A sandbox is not a product you buy. It is an architecture you build — layer by layer, each layer assuming the one below it will break.
Having a sandbox is not the same as having a security architecture. The first is a feature. The second is a stack.
Replit's security stack is thirteen layers deep. Zero-trust service-to-service auth. Linux containers hardened with seccomp-bpf. Per-customer GCP Projects for tenant isolation. MicroVM migration underway to eliminate the shared kernel. An append-only Git sidecar — history survives even if the agent deletes .git. A transparent secrets proxy — application code never sees credentials. MCP tool calls scanned for prompt injection. Built-in auth via Clerk — the agent never implements authentication from scratch. Forkable databases so development never touches production. Determinate Nix for supply chain integrity. HackerOne and Trail of Bits for continuous external assessment. An internal AI red-teaming harness that scans, prioritizes, and validates findings before engineers are engaged.
Thirteen layers. Each layer assumes the one below it will fail. When one does — and one always does — the rest hold. This is not paranoia. This is engineering.
The design principle is defense in depth. It is the opposite of trusting a single boundary. A container is not a sandbox. A microVM is not a sandbox. A hypervisor is not a sandbox. Each is a layer of a sandbox. The sandbox is the stack — the accumulated constraints that make the agent's behavior predictable even when one constraint fails.
The stack is the design abstraction. Each layer constrains a region of the failure space. A container constrains host compromise. A microVM constrains kernel sharing. A transparent proxy constrains secret leakage. An append-only sidecar constrains history deletion. No single layer is sufficient. The stack is the accumulated set of constraints.
The agent is non-deterministic. The sandbox is the constraint that bounds the non-determinism. When the agent does something unexpected, the sandbox ensures the unexpected stays contained.
The hardest part of sandboxing is not the technology. It is the posture. You must accept that every layer will eventually fail and build the next one anyway. You must resist the temptation to declare the system secure because it passed a penetration test. Compliance is not security. A clean pen test is a snapshot. The only honest posture: assume compromise, contain the blast radius, monitor continuously, respond fast, harden the root cause, repeat.
The companies that get sandboxing wrong believe their own marketing. The ones that get it right have been attacked for a decade and learned what a single layer of isolation cannot do.
References:
- Amjad Masad. Sandboxes Are Hard. LinkedIn, July 2026.
- Replit. Defense in Depth: How Replit Secures Every Layer of the Vibe Coding Stack. Replit Blog, 2026.
- George Fahmy. The Agent Sandbox Taxonomy. GitHub, 2026. — Open-source taxonomy of sandboxing approaches.
- gVisor — Google's application kernel for container sandboxing.
- Firecracker — AWS's microVM for multi-tenant isolation. Powers Lambda and Fargate.
- Trail of Bits — Security assessment of Replit's infrastructure.
- Clerk — Authentication-as-a-service. Eliminates entire classes of auth bugs.
- Semgrep — Static analysis for vulnerability detection in the scanning pipeline.
- HoundDog — Privacy issue detection in pre-publish security scanning.
- HackerOne — Bug bounty and continuous penetration testing platform.
- Related: The Stack as a Design Abstraction — Each layer constrains the failure space.
- Related: Durable Daemons — Pattern Specification — Trustworthy agents require defense in depth.