Cloudflare published a reassessment of remote Spectre attacks against Workers on 19 August. After its 2021 assessment it had shipped a production defence, Dynamic Process Isolation, which identifies suspicious-looking scripts and isolates them into separate processes. Since then, techniques for stabilising Spectre attacks improved, so the team rebuilt an updated proof-of-concept on the production environment to measure the risk under real workloads rather than in a lab.
The result is the useful part: the research uncovered a limitation in the implementation of Dynamic Process Isolation. The write-up is explicit about why a production proof-of-concept is harder than a paper one — an external attacker has to overcome activity on shared hardware, interrupts, context switches and coarse-grained timers — which is exactly why an unexercised defence tends to look stronger than it is.
That is the recurring lesson of running untrusted code for agents: VM isolation is only one containment boundary, and a heuristic that decides which workloads deserve isolation is itself an attack surface. The sandbox hub collects the cases where the boundary held for the wrong reason.
The post is Cloudflare's own research on its own platform, and the specific limitation and its mitigation are described by the party that shipped both. The condition to watch is whether the isolation heuristic's selection criteria get published or independently tested, because a defence that triggers on maliciously looking scripts depends entirely on what looking malicious means.