12 bit/s From Your Tenant's Heap: Cloudflare's Spectre Reset and the Future of AI Agent Isolation
胡新宇
Published on 2026-08-21
On Aug 19, 2026, Cloudflare and the University of Edinburgh published a remote Spectre attack running in Workers production — 12 bit/s leakage, 99% accuracy. What the V8 Sandbox + MPK + improved DyPrIs response means for every AI agent platform built on shared edge runtimes.
12 bit/s From Your Tenant's Heap: Cloudflare's Spectre Reset and the Future of AI Agent Isolation
On August 19, 2026, Cloudflare and a team from the University of Edinburgh published arXiv 2608.17043, reporting a remote Spectre attack that ran on Cloudflare Workers' production environment and leaked a co-tenant's memory at 12 bits per second with 99% accuracy (Cloudflare Blog, revisiting-spectre-attacks-on-workers). The 2021 version of this attack managed 120 bits per hour. The 2026 version is roughly 360× faster.
The disclosure is not a "we got owned" story. Cloudflare shipped fixes before the paper went public and reports no evidence of real-world exploitation over the past three years. What it is, is a forced redesign of how multi-tenant edge compute earns the word isolation.
If you build AI agent platforms on Workers, V8 isolates, or any shared-runtime edge stack, the threat model you sold your customers just changed.
What actually happened in production
The attack chain looks clean on paper and ugly in practice. Six stages, each one a separate paper if it stood alone:
Co-location. A fetch("https://victim.example") from the attacker's Worker schedules the victim isolate into the same OS process, almost always. Cloudflare operates tens of thousands of edge servers, but the scheduler happily co-locates tenants to keep startup latency low.
#AI Agent#AI工程#上下文工程
12 bit/s From Your Tenant's Heap: Cloudflare's Spectre Reset | New Universe
Timer calibration. WebSocket round-trip to a remote timestamp service. Workers freezes local timers, so the attacker stands up a noisy but adequate substitute.
Speculative type-confusion gadget. A branch on obj instanceof ObjP is mistrained. The CPU speculates along the "yes" path, follows a raw 64-bit pointer the attacker controls, and reads one bit out of bounds — into the probe array.
PLRU amplification. A single cache hit/miss is a few nanoseconds; a remote timer is microseconds to milliseconds noisy. Stephen Röttger and Artur Janc's tree-based PLRU pattern amplifies that gap into something classifiable.
64-bit arbitrary read. The first gadget leaks the isolate root. A second gadget — two large objects whose type field and target field land on different cache lines — converts the leak into an arbitrary-address read.
Bit-by-bit extraction. A JWT placed in the victim Worker is read one bit at a time, classified with a two-sided test, majority-voted. Result: 12 bit/s, 99% accuracy in production. Higher rates are possible at the cost of accuracy (Cloudflare Blog, "A revisit of remote Spectre attacks").
The whole thing runs inside a single Durable Object with periodic WebSocket keep-alives, because every keep-alive resets the 30-second CPU limit and the 1,000-subrequest cap. The attack lives inside one logical Worker invocation for hours.
Why DyPrIs, the 2021 defense, didn't catch it
DyPrIs (Dynamic Process Isolation) watches hardware performance counters. When a script looks Spectre-shaped — branch mispredictions per iTLB access, mostly — the runtime parks the script into a separate process after the invocation ends.
Two specific gaps let the new attack walk past it.
First, isolation runs after the script finishes. A normal Worker invocation lasts milliseconds. DyPrIs has time. A Durable Object running WebSocket keep-alives runs for 5 to 20+ hours in a single invocation. The attack completes long before the post-execution handoff happens.
Second, the normalization metric is brittle. DyPrIs measures branch mispredictions normalized by iTLB accesses. WebSocket I/O inflates iTLB activity. The ratio stays under the threshold. The script looks like ordinary network traffic, not a side-channel attack.
The lesson is older than Spectre: a detection signal that only triggers at the end of a long-running session is not a defense, it's an autopsy.
The three new layers Cloudflare shipped
The fix isn't a single patch. It's a layered reset that pushes isolation down into the language runtime and the hardware.
1. V8 Sandbox. The goal is to remove raw 64-bit pointers from most of the JavaScript heap. Once TypedArray backing stores no longer expose those raw pointers, the speculative type-confusion gadget stops being reusable. It's not a complete Spectre mitigation — other gadgets may exist — but it cuts a wide class of memory-corruption primitives off at the root.
2. Memory Protection Keys (MPK), deployed September 2025. MPK lets one process divide memory into protection domains and switch access rights cheaply. Workers use it to wall off each isolate's heap behind a hardware-enforced boundary. A wrong-key access is denied by hardware. The straightforward cross-isolate heap read this attack relied on becomes a fault.
3. Improved DyPrIs. Long-lived executions and I/O-heavy workloads are now treated as a first-class security case, not background noise. The team is investigating whether remote timing patterns themselves can become an additional behavioral signal — repeated timer-like I/O around compute-heavy sections.
Each layer alone wouldn't be enough. Together, they raise the cost of a successful side-channel from "one buggy branch" to "three independent primitives, two of which are hardware-dependent."
What this means for AI agent platforms
Cloudflare spent 2026's Agents Week positioning Workers as the runtime for AI agents — durable objects for state, Email Service for outbound, AI Search as a primitive. The Spectre paper doesn't break that pitch, but it forces the question every agent platform now has to answer in writing:
What does "tenant isolation" mean on shared infrastructure in 2026?
Three concrete shifts worth watching:
Memory-safety primitives become a feature. V8 Sandbox work was previously invisible to platform buyers. After this paper, anyone running untrusted code on shared edge runtimes will ask "what's your MPK story?" The next round of agent-platform comparisons will include a column that didn't exist last year.
Hardware-enforced isolation moves up the stack. ARM's Memory Tagging Extension (MTE), RISC-V's CHERI, and Intel's CET were academic curiosities in 2021. In 2026 they're the architectural primitives any serious multi-tenant runtime has to plan around. Cloudflare's MPK deployment is the first high-profile edge case study.
Post-execution detection loses its crown. Runtime monitors that only react after a session ends can't defend 20-hour Durable Object invocations. Real-time behavioral signals — long-running compute mixed with periodic network I/O — become a baseline expectation. Anything else is a future autopsy.
The bigger reset is philosophical. Process-level isolation was the deal we sold customers for forty years: "your code runs in your process, my code can't touch it." Speculative execution broke that deal in 2018. The Cloudflare paper shows the consequences haven't been fully paid down yet. The new deal is: isolation is a stack, not a wall — language runtime, hardware primitives, and behavioral detection, each carrying part of the load.
What doesn't kill Spectre, and what might
Cloudflare is honest about the limits. V8 Sandbox doesn't stop every variant. MPK has a finite number of hardware domains and needs careful state management. Improved DyPrIs still can't eliminate remote communication with attacker-controlled infrastructure.
The deeper question is whether any combination of software mitigations fully closes speculative execution side channels. Today's honest answer is: probably not, on current CPUs. The architectural fix is MTE, CHERI, and CET — but those need silicon adoption across every cloud region before they can replace software mitigations.
Until then, every multi-tenant edge runtime is making the same bet Cloudflare is: raise the attack's cost by orders of magnitude, treat any successful leak as a security event, and publish the result so the rest of the industry can plan around it.
That's what the August 19 paper actually is. Not a confession. A roadmap — for Cloudflare, and for every other platform that runs your code next to someone else's.
Sources: Cloudflare Blog, "A revisit of remote Spectre attacks on Cloudflare Workers" (2026-08-19), link; arXiv 2608.17043 (Pedersen, Xiao, Ainsworth, Topham, Schwarzl). Underlying research conducted 2024–early 2025.
