---
type: "post"
slug: "cloudflare-spectre-attack-against-workers"
title: "Cloudflare Spectre attack against Workers"
description: "Cloudflare rebuilt a remote Spectre proof-of-concept against production Workers and found a limitation in the process-isolation defence it shipped after the 2021 assessment."
retrieval_nugget: "Cloudflare rebuilt a remote Spectre proof-of-concept against production Workers and found a limitation in the process-isolation defence it shipped after the 2021 assessment."
published_at: "2026-09-01"
updated_at: "2026-09-12"
record_date: "2026-08-19"
date_kind: "published_at"
topics: ["agent-security","agents","ai","security"]
entities: ["Cloudflare"]
source_url: "https://blog.cloudflare.com/revisiting-spectre-attacks-on-workers"
source_title: "A revisit of remote Spectre attacks on Cloudflare Workers"
source_domain: "blog.cloudflare.com"
source_terms: ["Cloudflare","Spectre","attack","Workers","production"]
summary_word_count: 193
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:cloudflare-spectre-attack-against-workers"
status: "published"
source_urls: ["https://blog.cloudflare.com/revisiting-spectre-attacks-on-workers"]
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:88b1389fd2a5a726d12ffa83fdabf8c87e20bf1b102553a7938a77e4a7418f94","reviewed_at":"2026-09-12T10:00:00Z","source_evidence_count":1,"verified_claim_count":2,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":2,"implication_count":1,"watch_condition_count":1,"related_record_count":2}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Cloudflare published a reassessment of remote Spectre attacks against Workers on 19 August.","observed_facts":[{"text":"The research uncovered a limitation in the implementation of Dynamic Process Isolation.","source_urls":["https://blog.cloudflare.com/revisiting-spectre-attacks-on-workers"]},{"text":"Cloudflare built an updated remote Spectre proof-of-concept on its production Workers environment.","source_urls":["https://blog.cloudflare.com/revisiting-spectre-attacks-on-workers"]}],"mechanism":"Since then, techniques for stabilising Spectre attacks improved, so the team rebuilt an updated proof-of-concept on the production environment to measure the risk under real workloads rather than in a lab.","why_now":"After its 2021 assessment it had shipped a production defence, Dynamic Process Isolation, which identifies suspicious-looking scripts and isolates them into separate processes.","implications":["a heuristic that decides which workloads deserve isolation is itself an attack surface"],"evidence_boundary":"The post is Cloudflare's own research on its own platform, and the specific limitation and its mitigation are described by the party that shipped both.","watch_conditions":["The condition to watch is whether the isolation heuristic's selection criteria get published or independently tested, because a defence that triggers on maliciously looking scripts depends entirely on what looking malicious means."],"related_records":[{"url":"https://newruntime.com/posts/vm-isolation-is-only-one-agent-containment-boundary","relation":"Prior coverage of containment boundaries beyond the obvious one."},{"url":"https://newruntime.com/topics/sandbox","relation":"Topic hub for isolation of untrusted execution."}]}
routes: {"html":"https://newruntime.com/posts/cloudflare-spectre-attack-against-workers/","markdown":"https://newruntime.com/posts/cloudflare-spectre-attack-against-workers.md","json":"https://newruntime.com/posts/cloudflare-spectre-attack-against-workers.json"}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
---

# Cloudflare Spectre attack against Workers

## Retrieval answer

Cloudflare rebuilt a remote Spectre proof-of-concept against production Workers and found a limitation in the process-isolation defence it shipped after the 2021 assessment.

Cloudflare published a reassessment of remote Spectre attacks against Workers on 19 August. After its 2021 assessment it had shipped a production defence, Dynamic Process Isolation, which identifies suspicious-looking scripts and isolates them into separate processes. Since then, techniques for stabilising Spectre attacks improved, so the team rebuilt an updated proof-of-concept on the production environment to measure the risk under real workloads rather than in a lab.

The result is the useful part: the research uncovered a limitation in the implementation of Dynamic Process Isolation. The write-up is explicit about why a production proof-of-concept is harder than a paper one — an external attacker has to overcome activity on shared hardware, interrupts, context switches and coarse-grained timers — which is exactly why an unexercised defence tends to look stronger than it is.

That is the recurring lesson of running untrusted code for agents: [VM isolation is only one containment boundary](https://newruntime.com/posts/vm-isolation-is-only-one-agent-containment-boundary/), and a heuristic that decides which workloads deserve isolation is itself an attack surface. The [sandbox hub](https://newruntime.com/topics/sandbox/) collects the cases where the boundary held for the wrong reason.

The post is Cloudflare's own research on its own platform, and the specific limitation and its mitigation are described by the party that shipped both. The condition to watch is whether the isolation heuristic's selection criteria get published or independently tested, because a defence that triggers on maliciously looking scripts depends entirely on what looking malicious means.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- topic hub: [Agents](https://newruntime.com/topics/agents.md): Explore the agents topic hub.
- topic hub: [Ai](https://newruntime.com/topics/ai.md): Explore the ai topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)