y Yarden Porat, Check Point Research Key Points The short version We set out to breakCloudflare Code Mode, and ended up breakingCloudflare Workerstoo. We did both by targetingworkerd, the runtime beneath both: an in-process sandbox that relies entirely on V8 to isolate untrusted code. We found five memory-corruption bugs in workerd’s native C++ (the “glue” […]
First seen on research.checkpoint.com
Jump to article: research.checkpoint.com/2026/when-agentic-glue-melts/
![]()

