On 7 November 2026 at 18:30 UTC, xray@web-summit.dinis typed one line into the search tool (admin/tools/xray-search.mjs): "Replit", as a company. It was not typed at the booth: that path is still being built (WS-194).
The search tool is the orchestrator. It sent the same question to 4 search agents at the same moment, through OpenRouter, and waited for all of them. Each was told to search the public web and answer only in JSON, with a URL for every item.
Perplexity searchperplexity/sonar
OpenAI searchopenai/gpt-5.4-nano:online
Gemini searchgoogle/gemini-3.1-flash-lite:online
OpenRouter web searchanthropic/claude-haiku-5.5
The exact question each agent was sent
You are a research agent for RiskMandate X-ray. Subject (a company): "Replit".
Search the public web and answer ONLY with JSON, no prose around it and no code fences:
{"what_it_does": "two sentences", "ai_agents": [{"name": "", "what_it_does": "", "actions": ["what the agent can do: tools, systems, data it touches"], "source": "url"}],
"use_cases": [{"name": "", "who_uses_it": "", "what_the_agent_can_reach": ["systems, data, money, people it can act on"], "source": "url"}],
"incidents_or_risks": [{"what": "", "when": "", "source": "url"}],
"facts": [{"claim": "", "source": "url"}]}
Public, professional facts only; every item must carry the URL it comes from; nothing about private individuals; no contact details. If you find nothing for a field, give an empty list.
Rebuilt from admin/tools/xray-ask.mjs with this run's subject and kind. The question has not changed since the first run.
Step 2 of 6
2. Each search agent's call
Each search agent is a model, called through OpenRouter, asked to search the web and answer in JSON. All 4 started together; each bar runs from the moment the question went out to the moment its answer came back. The whole fan-out took 19.7 s, the time of the slowest.
Perplexity search5.9 s
OpenAI search7.9 s
Gemini search2.0 s
OpenRouter web search19.7 s
0 s5 s10 s15 s
Perplexity search
perplexity/sonar
Time
5.9 s
Tokens in / out
206 / 824
Cost
$0.0060
Finished
stop: it finished its answer
URLs given
16 (15 returned as citations, 10 named in its answer)
Items in its answer
13
Leads checked
14: 13 confirmed, 0 not found, 1 unverified
Some of what it said, word for word:
Replit describes itself as an AI platform for creating, launching, and growing apps, sites, tools, and businesses in one place.
Replit Agent can build apps, websites, designs, slides, and more from plain language.
Replit Agent can create other agents and automations.
OpenAI search
openai/gpt-5.4-nano:online
Time
7.9 s
Tokens in / out
8,983 / 1,088
Cost
$0.0124
Finished
stop: it finished its answer
URLs given
5 (0 returned as citations, 5 named in its answer)
Items in its answer
11
Leads checked
9: 8 confirmed, 1 not found, 0 unverified
Some of what it said, word for word:
Replit positions itself as an AI platform that helps users turn ideas into real outcomes by using an AI-driven development workflow.
Replit launched “Replit Agent,” described as an AI system that can create and deploy applications.
Replit’s Ghostwriter is described as an ML-powered pair programmer with tools to generate, transform, and explain code, plus an in-editor search utility for finding/importing open-source code.
Gemini search
google/gemini-3.1-flash-lite:online
Time
2.0 s
Tokens in / out
224 / 450
Cost
$0.0007
Finished
stop: it finished its answer
URLs given
5 (0 returned as citations, 5 named in its answer)
Items in its answer
5
Leads checked
6: 1 confirmed, 5 not found, 0 unverified
Some of what it said, word for word:
Replit supports over 50 programming languages.
Replit operates a platform that allows for real-time multiplayer collaborative coding.
Replit Agent: An autonomous AI software engineer capable of building full-stack applications from natural language prompts.
OpenRouter web search
anthropic/claude-haiku-5.5, with OpenRouter's web search plugin
Time
19.7 s
Tokens in / out
50,926 / 4,082
Cost
$0.0368
Finished
stop: it finished its answer
URLs given
11 (0 returned as citations, 11 named in its answer)
Items in its answer
16
Leads checked
20: 15 confirmed, 2 not found, 3 unverified
Some of what it said, word for word:
Replit was founded in 2016 and is described by Wikipedia as an American company operating a cloud-based platform for writing and running software, which later added AI code-generation tools.
Replit is a private company with a reported latest valuation of about $9 billion.
Replit has achieved SOC 2 Type 2 attestation, which covers its own security controls but does not automatically certify applications built on the platform.
"Citations" are the URLs OpenRouter returned beside the answer; only Perplexity returns them for a JSON answer. "Named in its answer" are the URLs inside the JSON. Both are leads: nothing is taken from them until a source is read. "Tokens in" is how much each model was given to read: thousands when web results were added to the question, a few hundred when it had little beyond the question itself (see the experiments on whether Gemini searched at all).
Step 3 of 6
3. From claims to facts
What a model says is a lead. Only what we read on its source reaches the page.
The reading agent turned the 4 answers into 49 leads, each tagged with the model that said it, and looked for each one on a source it read. 37 confirmed, 8 not found, 4 unverified.
3784
confirmednot foundunverified
Confirmed: a source we read says it.
Not found: we read the source, or looked for one, and it does not say it.
Unverified: we could not read the source (for example, the site refused us), so it stays a lead.
Agent
Leads
Confirmed
Not found
Unverified
Perplexity search
14
13
0
1
OpenAI search
9
8
1
0
Gemini search
6
1
5
0
OpenRouter web search
20
15
2
3
All
49
37
8
4
What did not hold up, and why
Model
What the model said
Status
Why
perplexity
A 2024 Reddit thread criticised Replit's AI Agent as expensive for fixes and unreliable.
unverified
reddit.com returned 403 (blocked) to this machine.
openai
The GitHub credentials exposure happened on 2024-04-02.
not-found
Replit's page dates the discovery to April 2, 2023.
gemini
Replit Agent is an autonomous AI software engineer (cited page blog.replit.com/agent).
not-found
The cited page returns 404. Agent capabilities are confirmed elsewhere (s3).
gemini
Rapid application prototyping use case reaching code repositories, cloud infrastructure, database integrations and deployment (cited page replit.com/site/agent).
not-found
The cited page returns 404.
gemini
Security researchers identified vulnerabilities around unauthorised access to environment variables in hosted repls (2023), per replit.com/security.
not-found
replit.com/security says nothing about such a finding.
gemini
Replit supports over 50 programming languages (replit.com/languages).
not-found
The cited page redirects to replit.com/templates, which returns 404.
The cited page returns 404. Replit's 2022 blog mentions Multiplayer Mode announced in 2018 (s21).
openrouter
In that use case the agent reaches third-party services such as Stripe and Google Workspace (cited: the Agent launch post).
not-found
The launch post mentions replacing Zapier or Make but not Stripe or Google Workspace; those integrations are on replit.com (s1).
openrouter
Replit's latest valuation is about $9 billion.
unverified
trueup.io returned 403 (blocked).
openrouter
Replit reported about $150 million annualised revenue in September 2025 and targets $1 billion run-rate by end of 2026.
unverified
getpanto.ai returned 503.
openrouter
Teams at Atlassian, LabCorp, PayPal, Zillow, Talkdesk, Adobe and UKG use Replit.
unverified
getpanto.ai returned 503.
openrouter
Replit is on Google Cloud Marketplace in 2026 (per Wikipedia).
not-found
The Wikipedia article read today does not say this.
Step 4 of 6
4. The reading agent
A reading agent: a Claude Code sub-agent of xray@web-summit.dinis, one per subject. It opened the sources the leads pointed to (and others it found), read them, and wrote the X-ray: every fact with its source and the date read. It finished at 7 November 2026 at 18:47 UTC.
The reading was done by a Claude Code sub-agent in the session: no OpenRouter spend. Its cost is not recorded in dollars, only as about 200 thousand tokens.
19.7 sthe search, four agents in parallel
7 minthe reading
17 minfrom the search starting to the reading finished
60,339 / 6,444search tokens in / out
The time between the search and the start of the reading, and the time the review took, are not recorded.
What RiskMandate is and is not in this
The X-ray is a demonstration, made by agents. RiskMandate measures what your agents can actually reach, evidences the controls that contain them, prices the exposure, and produces that record. It is never in the request path: read-only by design (riskmandate.ai/llms.txt). Nothing on this page claims more for it.
For an agent: this page is https://web-summit.sgit.ai/xray/replit/run/index.html (markdown: https://web-summit.sgit.ai/xray/replit/run/index.md). Site index for agents: https://web-summit.sgit.ai/llms.txt. Source: https://github.com/SGit-AI/SGit-AI__Website__Web-Summit (release branch dev). Identity of the agent that runs this site: https://web-summit.sgit.ai/agent/index.html.