When Agentic Glue Melts Exploiting Cloudflare Code Mode and Workers
When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers
Check Point Research has conducted an in-depth analysis of Cloudflare Code Mode, a technique that transforms how AI agents utilize MCP by converting tools into a TypeScript API that the model can write code against. This research has uncovered five vulnerabilities in workerd, the open-source runtime behind Code Mode and Cloudflare Workers. Notably, two of these vulnerabilities have been rated Critical by Cloudflare.
The implications are significant: according to Cloudflare, Workers is developed by millions of developers, processes millions of requests per second, and accounts for over 10% of all traffic on its network. Given that workerd supports both Code Mode sandboxes and Workers tenant isolation, these findings pose serious risks of sandbox escape and cross-tenant exposure.
The researchers stated, “We set out to break Cloudflare Code Mode, and ended up breaking Cloudflare Workers too.” They achieved this by targeting workerd, which is the runtime for both: an in-process sandbox that relies entirely on V8 to isolate untrusted code. They identified five memory-corruption bugs in workerd’s native C++ and successfully turned them into two end-to-end attacks. These include a Cross-tenant heap swipe, where an out-of-bounds read in URLPattern allows one Worker to access another tenant’s secrets, and a Code Mode sandbox escape, which starts from a prompt injection and involves a use-after-free in node:zlib, enabling the execution of native code on the host.
Cloudflare Workers is Cloudflare’s serverless platform: you upload a piece of code, and Cloudflare executes it at the edge, in data centers close to the user, on demand for every request. This model presents a significant isolation challenge. Cloudflare runs code from a vast number of different customers, and to minimize latency and costs, it consolidates many of them onto the same machines, and often into the same process. Cloudflare’s solution is to isolate at the language-runtime level rather than the OS level, utilizing V8 isolates, the same technology that Chrome uses to separate browser tabs. An isolate is a lightweight, independent JavaScript context that can coexist within a single process. Each isolate starts in single-digit milliseconds, and it serves as the security boundary between tenants. However, this boundary is a software boundary within a shared address space, rather than a hardware or kernel boundary. Untrusted code runs in-process, and the entire model relies on the integrity of the isolate.
Fortunately, Cloudflare’s managed Workers environment has been fixed in production. Self-hosted workerd / Code Mode deployments should update to v1.20260619.1. Check Point Research has also released proof-of-concept code as part of its Black Hat USA 2026 presentation.
For more details, Read full article