AI Security

Which Permissions Should a Replit AI Agent Never Get by Default?

Published 2026-09-14 by AISecAll Editorial

TL;DR: When you spin up a Replit AI Agent, start with a deny‑list that blocks file‑system write, shell execution, network outbound, and secret‑reading capabilities. Grant only the specific read‑only APIs your workflow needs, enforce the policy via the Replit manifest, and continuously audit the agent’s activity with logs and alerts.

What does a Replit AI Agent actually do?

Replit’s Agent feature lets you attach a language model to a Replit project so the model can run code, read files, and call external services. By default the platform gives the agent a fairly broad sandbox that includes:

• Read/write access to the project’s file system
• Ability to spawn a shell process (e.g., bash)
• Network access to any outbound endpoint
• Read access to environment variables (including secrets)

For a solo founder or a small team, that convenience can quickly become a security risk if the model is tricked into executing malicious prompts.

Why a least‑privilege baseline matters for AI agents

AI agents are essentially programmable users. If an attacker can inject a prompt that causes the model to run arbitrary commands, they inherit every permission the agent holds. The OWASP GenAI Security Project recommends a “never‑grant” list for all LLM‑driven agents, and Replit’s sandbox makes it easy to apply those controls at launch.

Permissions that should be denied by default

Below is a concise deny‑list tailored to Replit agents. Each item includes a short rationale and a practical way to enforce the restriction.

1. File‑system write access – Prevents the agent from creating, modifying, or deleting code, configuration files, or data. Use the readOnly flag in the replit.json manifest to lock the workspace to read‑only mode.
2. Shell / subprocess execution – Stops the model from running bash, python, or any other interpreter. Set allowShell: false in the agent configuration (see Replit docs for the exact key).
3. Outbound network calls – Blocks data exfiltration and untrusted API usage. Define an explicit whitelist of allowed domains under allowedOrigins and reject the rest.
4. Reading environment variables that contain secrets – Keeps API keys, DB passwords, and other credentials out of the model’s context. Remove the REPLIT_SECRET_* variables from the agent’s environment or store them in a secret manager that the agent cannot query.
5. Access to other Replit projects – Prevents lateral movement across your organization’s workspaces. Ensure the agent’s OAuth token (if any) is scoped to a single project only.

How to enforce the deny list in Replit

Replit lets you configure the agent via the replit.json file placed at the root of the project. A minimal hardening manifest looks like this:

{
  "agent": {
    "model": "gpt-4o-mini",
    "allowShell": false,
    "readOnly": true,
    "allowedOrigins": ["https://api.myservice.com"],
    "envWhitelist": []
  }
}

Key points:

• allowShell: false disables any exec‑style calls.
• readOnly: true forces the file system into a read‑only mount.
• allowedOrigins acts as a network whitelist; any attempt to fetch outside the list will raise an error.
• envWhitelist is empty, meaning no environment variables are exposed to the model.

After committing the manifest, restart the agent so the new policy takes effect.

Monitoring and revoking excess rights

Even with a strict deny‑list, you should keep an eye on what the agent actually does. Replit emits audit events that can be streamed to a logging service (e.g., Logtail, Datadog). Capture at least the following fields:

• Timestamp
• Agent ID
• Action type (file read, network request, env read)
• Resource target (file path, URL, env var name)
• Result (success, denied, error)

Set up an alert for any denied event – it indicates the agent tried to exceed its permitted scope and may be under a prompt‑injection attack.

When you need to relax a restriction

Business needs evolve. If a workflow truly requires write access (e.g., generating a report file), grant that permission only for the specific step and revoke it immediately after. You can achieve this by:

1. Creating a short‑lived sub‑agent with readOnly: false and a unique token.
2. Running the sub‑agent inside a separate Replit “run” command.
3. Deleting the sub‑agent token as soon as the task finishes.

This pattern mirrors the “just‑in‑time” privilege model recommended by NIST’s AI Risk Management Framework.

Bottom line

Start every Replit AI Agent deployment with a deny‑list that blocks file writes, shell execution, outbound networking, and secret exposure. Use the manifest to codify the policy, stream audit logs for continuous visibility, and only relax controls for narrowly scoped, time‑boxed tasks.