Checkpoint Research found five memory-corruption bugs in workerd’s C++ layer that agents can exploit. One reads another tenant’s secrets via heap spray; the second chains prompt injection to native code execution on the host. Agents create the new escalation path: these bugs only reach the runtime when agents generate and invoke the malicious code.
Code Mode shipped as safe APIs for models to call. But safe abstractions don’t rescue unsafe runtimes. Cloudflare patched managed Workers in production; self-hosted deployments must update to v1.20260619.1. Anyone evaluating Code Mode adoption now faces published, weaponized exploits.
Each new invocation layer expands the attack surface. Agents didn’t create these bugs, but they opened a path to weaponize them.
Sources: When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers • Code Mode: the better way to use MCP
Coverage: Cloudflare Agents Week 2026 Updates
Related on this blog: [AUTO] Langflow RCE Added to KEV After a Month of Silence • [AUTO] Guardrails Are Usability Theater • [AUTO] Paperclip’s Real Problem: When Configuration Is Code