Replit Weekly: Self-Driving Companies and the New Paradigm of AI Programming

Introduction: When Companies Become "Self-Driving"

In this week's updates, Replit put forward an ambitious judgment: by the end of 2030, every Fortune 500 company will become a "Self-Driving Company." This concept does not mean AI replaces humans, but rather emphasizes a new division of labor in human-AI collaboration—humans remain in the driver's seat, responsible for judgment, creativity, and taste, while AI agents handle execution-level work.

Behind this vision is Replit's sustained push across the AI programming toolchain. From natural language code generation to security isolation mechanisms, and on to benchmarks for long-horizon software construction, this week's developments sketch a clear throughline: making software development more automated, more secure, and more measurable.

Natural Language Straight to the Codebase: Replit Cloud Agents

The most eye-catching feature update this week is the opening of Replit Cloud Agents. Now anyone can describe requirements in natural language, and Cloud Agents will turn them into tested pull requests, while engineers retain final approval over the code. This means non-technical team members can contribute code directly to the company codebase without sacrificing quality control.

According to official sources, Replit's own design team has used the tool over the past 6 months to safely deliver more than 250,000 lines of code. This figure comes from internal practice, showing that Cloud Agents are already usable in real production environments. The feature is currently available to Pro and Enterprise users, who can enable it by connecting a code repository.

From a product perspective, this lowers the barrier to software development without weakening the engineering team's control—the approval step keeps "humans in the loop."

Pull Request is a core collaboration mechanism in distributed version control systems (such as Git): after a developer completes changes on a separate branch, they submit a merge request to the main repository, where the code owner reviews, comments, requests changes, or approves, ultimately deciding whether to merge. It has become a key link in quality control because all changes are explicitly displayed and discussed before entering the mainline, making it easy to spot defects, control risk, and leave an audit trail. Cloud Agents turning natural language requirements into tested pull requests is essentially bringing AI-produced code into the existing review process rather than writing it directly to the codebase. This also explains why non-technical members can contribute code without breaking engineering standards—approval authority remains with engineers, and AI only automates the "writing code" step, while the judgment of "whether to accept the code" is still made by humans.

Security Must Scale Alongside Agent Autonomy

As AI agents take on more execution tasks, security becomes an unavoidable issue. In this update, Replit emphasized its existing isolation protections: the kernel vulnerability disclosed last week could not be exploited precisely thanks to this layer of protection. At the same time, Replit centrally patched the affected tools, reducing the fixes developers need to handle individually.

CTO Luis Héctor Chávez explained the currently available security measures and future plans in a related link. Although the original text does not elaborate on technical details, it is clear that Replit treats security as the foundation of agent autonomy—without scalable security mechanisms, large-scale use of agents is out of the question.

Kernel Vulnerability refers to a security flaw at the operating system kernel level. The kernel is the highest-privilege component of the system, responsible for process scheduling, memory management, and hardware access, so once exploited, attackers can often gain the highest privileges and break out of containers or sandbox boundaries. For cloud development platforms running AI agents, this means isolation mechanisms cannot rely only on application-layer restrictions but must also consider the attack surface of the underlying kernel. Replit's emphasis that its isolation protection kept the vulnerability from being exploited points to a defense-in-depth approach: even if one layer has a flaw, other layers can still prevent lateral movement and privilege escalation. This also shows that the higher the agent autonomy and the more operations it can perform, the more sandboxing, least privilege, and patch response speed must be upgraded in tandem.

ViBench 2.0: Measuring Long-Horizon Software Construction Capability

Another notable release this week is ViBench 2.0, a benchmark for long-horizon software construction. Unlike common code generation evaluations, ViBench 2.0 requires agents to start from an empty project, build one feature at a time, and gradually assemble a complete product, without being able to see subsequent requirements in advance.

The results are not encouraging: even the best models had only 49-65% of builds pass all checks. This data reveals the limitations of current AI in complex, multi-step software development tasks. ViBench 2.0 has been included in Fireworks AI's Specialized Intelligence Index, meaning it is becoming a reference standard for industry evaluation of agent capabilities.

For developers, this benchmark provides an evaluation dimension closer to real development scenarios—not single-point code correctness, but the reliability of sustained construction.

Benchmark is a test set and scoring process used to standardize the evaluation of AI model capabilities. Common code benchmarks mostly focus on single-function generation or competitive programming problem solving, with clear inputs and outputs and short steps, making it easy to score high through pattern matching. Long-horizon software construction benchmarks, by contrast, require agents to maintain state across multiple consecutive steps, make architectural decisions, and handle evolving requirements, which is closer to real engineering. ViBench 2.0 requires starting from an empty project, building features one by one, and being unable to foresee subsequent requirements—this tests "sustained delivery reliability" rather than "single-point accuracy." Its inclusion in Fireworks AI's Specialized Intelligence Index means this type of evaluation is moving from an academic metric to a reference for industry procurement and selection, helping determine whether agents can take on end-to-end construction tasks.

Other Updates: Models and Localization

There are two smaller updates this week: GPT-6.1 Terra is now available in Power Mode; and Replit now fully supports Japanese. The latter cannot be ignored for expanding into non-English markets, especially in a region like Japan with an active tech community.

In addition, the full replay is available, in which Clarisse Chan, Replit's Head of Financial Planning and Analysis, shared how the finance team builds its own tools on Replit. This indirectly demonstrates Replit's practice of "eating its own dog food" internally.

Analysis: The Next Stop for AI Programming

Looking at this week's developments together, Replit's strategy is becoming clear: on one hand, lower the barrier to programming so more people can participate in code contribution; on the other hand, use benchmarks and security management to ensure that participation does not get out of control. ViBench 2.0's low pass rate reminds us that long-horizon autonomous construction remains difficult, but the fact that Cloud Agents delivered 250,000 lines of code in real scenarios shows that assistive AI programming has crossed the usability threshold.

The concept of the "Self-Driving Company" may sound distant, but this week's updates show that the infrastructure supporting this vision is being assembled piece by piece.

One-line Summary

Replit releases Cloud Agents and ViBench 2.0, advancing the "Self-Driving Company" vision.

Paragraph Summary

This week's Replit updates revolve around the "Self-Driving Company" vision: humans retain judgment and creativity while AI agents handle execution. Core releases include Cloud Agents, which turn natural language requirements into tested pull requests while engineers retain approval authority, with Replit's design team delivering over 250,000 lines of code through it in half a year; on security, isolation mechanisms successfully defended against the kernel vulnerability disclosed last week and tools were centrally patched; the ViBench 2.0 long-horizon construction benchmark shows that even the best models pass all checks in only 49-65% of builds, and it has been included in the Fireworks AI index. In addition, GPT-6.1 Terra launched in Power Mode, and the platform fully supports Japanese. The overall strategy is to lower the programming barrier while ensuring controllability through benchmarks and security mechanisms.