When Agentic Glue Melts Exploiting Cloudflare Code Mode and ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2026/when-agentic-glue-melts
• Blog Title: When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers
• Suggested Section: Pentesting CI/CD > Cloudflare Security > Cloudflare Workers/workerd Sandbox Escape and Cross-Tenant Memory Corruption

🎯 Content Summary

Overview

Check Point Research audited workerd, the open-source C++ runtime underpinning Cloudflare Workers and Cloudflare Code Mode. Code Mode changes MCP-style tool use by exposing tools as a typed TypeScript API and having the LLM generate one program containing loops, branches, local data processing, and multiple tool calls. That generated program executes inside workerd, with tools exposed through bindings while direct filesystem access and arbitrary networking th...

🔧 Technical Details

Parallel metadata/value count mismatch: When a wrapper pairs regex captures returned by one engine with names or metadata generated by a separate parser, verify that both collections have identical lengths. Nested groups may be counted differently. If iteration uses the larger collection while indexing the smaller one, a one-past-the-end object can be interpreted as a native descriptor. For structures such as {ptr, size, disposer}, controlling adjacent bytes converts the OOB access into an arbitrary-address read.

Heap shaping through attacker-controlled vector length: If input syntax controls the number of elements in a native vector, padding the input can select an allocator size class. Spray controlled allocations in that class so one lands next to the vulnerable vector, making a one-element OOB access deterministic.

Free-list metadata as an ASLR disclosure: Prepare a chunk with a small length in bytes 8–1...

🤖 Agent Actions

Done — I updated:

• src/pentesting-ci-cd/cloudflare-security/README.md

Added a new Workers / workerd / Code Mode native attack surface subsection covering:

• native workerd / JSG attack surface outside isolate-focused protections
• URLPattern-style parallel metadata/value mismatch bugs
• node:zlib managed/native lifetime bugs
• iterator invalidation UAF patterns
• reserved-table rename → deserialization bridges
• exploitation patterns like heap shaping and length-field corruption
• practical review/detection ideas
• numbered ## References section with the Check Point research URL

I also verified the final diff to ensure the change is contained to that single file.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2026/when-agentic-glue-melts

Content Categories: Based on the analysis, this content was categorized under "Pentesting CI/CD > Cloudflare Security > Cloudflare Workers/workerd Sandbox Escape and Cross-Tenant Memory Corruption".

Repository Maintenance:

• MD Files Formatting: 590 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0