Kilo and Enkrypt AI: Guardrails your developers don't have to think about. How Kilo and Enkrypt AI stop leaked secrets and prompt injections before an agent acts on them. 5 hours ago Coding agents change what can leak out of an engineering org. When developers only typed code into an editor, a secret stayed on their machine unless someone committed it. With an agent, a developer can paste that secret into a chat and send it to a model provider the moment they hit enter. Agents also read files on their own, so a malicious instruction hidden in a README or design doc can steer the agent toward data it was never supposed to touch. Kilo integrates with Enkrypt AI's agent guardrails to catch both problems before they reach the model. Admins define the policies once, and developers keep working in the Kilo CLI or IDE extensions without checking every prompt against a security checklist. Setting policy from the Enkrypt dashboard. An admin or engineering manager creates guardrails in the Enkrypt dashboard and attaches policies to each one. The policies cover cases like malicious requests, sensitive information leaving a developer's session, and agents working outside the scope they were given. After the guardrails exist, a terminal wizard connects Enkrypt to Kilo at either the project level or the global level. Developers never have to write or maintain the rules; whoever owns security for the team decides what gets blocked. What a developer sees. Suppose a developer is racing to build an AI-native application and accidentally pastes an API key from their model provider into the Kilo CLI. Enkrypt blocks the prompt as soon as they send it, so the key never reaches the model, and Enkrypt's explanation of the block shows up directly in Kilo. The developer can strip out the key and resend without leaving the terminal. A prompt injection is harder to catch, because the developer usually has no idea it's there. Say the same developer switches to Kilo's VS Code extension and asks the agent to read an architecture file. Someone has buried a line in that file telling the agent to forget its prior instructions and pull sensitive information from other files in the repo. The agent starts on the request, but its Read tool call fails, because Enkrypt detected the injection before the agent or the model received the corrupted instructions. In both cases the developer's only extra work is reading the block message. Visibility for security and compliance. Enkrypt logs every action and violation, and security or compliance officers can review those logs in the Enkrypt platform. When they open a specific guardrail, they see a summary for each user along with the individual events behind it, so an auditor can trace a blocked prompt back to the user who sent it and the policy that caught it. Where this fits for teams rolling out Kilo. Kilo's Teams and Enterprise plans already let admins limit which models developers can use and track how the team adopts AI through usage analytics and the AI ROI Dashboard. Enkrypt's guardrails extend that control to the contents of each prompt and each tool call, which is where secrets and injected instructions actually show up. For an engineering leader deciding how widely to roll out agents, that division of labor matters. Security teams set and audit policy in Enkrypt at the project or global level, while developers keep using Kilo at full speed and only notice the guardrails when one of them fires. Launched a year ago Kilo is the all-in-one agentic engineering platform for software developers. 5M+ Kilo Coders. 60T+ tokens processed. Follow Kilo: kilo.ai/social

AI coding agents are blowing through budgets - Replit, Kilo Code, and Symbotic explain how they're managing it. 3 hours ago At Kilo Code, engineers are reading or writing code themselves only about 1% of the time now, according to co-founder Emilie Schario - the rest is agents. That shift is forcing new questions onto dev teams: which systems are safe to hand over, who cleans up when models goof up, how to support multi-model architectures, and whether skyrocketing token bills mean real progress or just burned IT budget. As far as tech leads from Replit, Kilo Code, and Symbotic are concerned, it's a natural - and welcome - evolution as agentic AI becomes embedded into more and more enterprise workflows. "Unless something's really broken or debugging, 99% of the time engineers are not reading or writing code anymore," Emilie Schario, co-founder of Kilo Code, said at VB Transform 2026. AI good at greenfield, not so great at brownfield. For Jared Go, distinguished engineer for AI and cloud at warehouse automation company Symbotic, the current moment is about directing the focus of AI. "These are my criteria," he said. "Let's look at it from the lens of security, elegance, clean, concise code, water tightness." That way, AI does most of the heavy lifting, and human code review isn't as critical. Human involvement becomes necessary further down the line, Go noted, because agents don't make strong product decisions. "Greenfield [building brand new codebases] is so easy for agents. Brownfield [writing, updating, or maintaining existing code] we all know is where the actual challenge lies." Replit takes a bit of a different tack: While the company has "gone very agentic," they've been more conservative with AI coding, explained Amol Jain, head of product engineering. An agent reviews each pull request (PR) and assigns it a risk score; low-risk PRs are self-merged by their author, while others go to human reviewers who read the code and give feedback. "The idea was human on the loop, not human in the loop," Jain said. Replit's internal tool is essentially self-driving for software engineers; devs give a task to agents, which do end to end planning, implementation, and testing. "It's a fleet of agents that run in their own cloud virtual machines (VMs) with access controls behind token proxies so they're secure," Jain said. He shared one example where an engineer couldn't repro or solve a "very gnarly bug" deep in its systems. It was sent to an AI manager agent, which told it to go to sleep. The manager agent then spun up a bunch of underlying agents that found the issue; it subsequently spun up a bunch more agents that found the fix. Six hours later, AI had a PR ready for the bug that had puzzled human engineers. Multi-model is the future. AI providers are also evolving beyond the lock-in model, as customers increasingly demand multi-model choice. Kilo Code, for its part, supports 500-plus models in its gateway. "Your software that you're using to do agentic engineering should be decoupled from the model that you're using to do it," Schario said. For instance, Schario said companies often use expensive frontier-tier models to architect a project, then switch to a less expensive open-weight model for the rest of the work. It's also important to respect model provider limitations, such as when they need to work in closed or isolated environments or providers in their specific regions. "It's factoring in what's important to you, what limitations you've set, what data retention policies you've established, what keys you've brought in, what commits you might have... into that routing decision," Schario said. Replit, similarly, tends to have a better sense of the cost versus capability spectrum than its customers, Jain contended. "We are essentially making the decisions on users' behalf of what model to use when, in what capacity, to minimize cost and maximize capability." To tokenmaxx or not to tokenmaxx. Of course, an important consideration as AI adoption increases is runaway costs, which has led to some enterprises tracking and capping AI use through tokenmaxxing. Concerns come from both sides, Schario said: internally and from customers. From the latter, she's hearing, "I accidentally spent my whole AI budget for the year... so what do I do now?" In response, Schario said Kilo Code points customers to the same workflow: use expensive models for planning, then open-weight models for affordability. Further, sharing skills, strong guidance, and Model Context Protocol (MCP) will empower models. "Realizing where you can really uplevel your team to help them get the most out of the models they're using is going to make a big difference," Schario said. Internally, meanwhile, Schario noted one particular engineer that has a "heavy foot" and is constantly at the top of the usage board. "I regularly have to nudge, 'What are you doing there?'" she said. It's easy to look at a $600 bill for daily work and react, "Wow, that's so much," but looking at the amount of work completed can sometimes justify the cost. "Cost per pull request is the metric that I'm paying attention to right now," Schario said. "It feels like the closest proximity for how I can measure value." Ultimately, AI changes how enterprises are thinking about ROI because spend is not the problem. "The spend with no return on that spend is the problem." Symbotic, for its part, has set per-month cost tiers for its employees. The company built a tool that gives managers visibility into PRs and usage trends. They can then move users up or down a tier as they see fit, Go explained. "Having a cap and seeing how many people went up in cap this month makes a big difference when you're trying to corral these costs and make things efficient," Go said. When Cursor - which Symbotic uses heavily - ended a legacy discount that had grandfathered the company into a flat per-request rate even for frontier models, and moved everyone to full pricing, it forced a company-wide reckoning on efficiency, Go said. "People were saying, 'You should try this model... This works better for this C# code, this whatever,'" he said. But the cost problem is increasingly moving out of IT; Replit, for one, broadened agents beyond engineering, and eventually found that a user on the support side had "blown through an insane amount of money," Jain said. When they looked under the hood, they figured out it was because they were running an automation on GPT 5.5 Pro Max. "At least till that point, the ROI was rather clear," Jain said. "We could see engineering productivity 3X, so no one had questioned it yet." Visibility that isn't "anti-productive," model routing, and sensible defaults are critical, he emphasized. "Most tasks do not need the frontier."