The Wipe Returned. Cloudflare's Old Sandbox Disks Had Not.

On 24 September Cloudflare published a joint account with Oren Yomtov of Accomplish. On 4 September, at 15:26 UTC, Yomtov reported through HackerOne that a Workers Paid container could read disk blocks a previous container on the same host had given back. Cloudflare Sandboxes, sold as a place to run untrusted code, including code written by AI agents, run on Containers and were affected. Cloudflare says the flaw is remediated, that customers need take no action, and that it has no evidence customer data was compromised.

High Cross-tenant residual read on a multi-tenant agent sandbox. High because the bytes can be another customer's files. The post does not name a victim, and it does not show a live disk being read while that neighbor was still attached.

Leftover blocks crossed tenants.#

Cloudflare is the primary. Containers place a workload on a host the customer does not pick. Each container gets a thin-provisioned root disk inside a Firecracker virtual machine. The affected pools used 64 KiB blocks. The pool was set to skip wiping a block before handing it out, which is not the usual default. When a deleted container returned its blocks to a pool shared by many accounts, the next container could receive them dirty.

A read of an unmapped region did not reveal the previous tenant. The allocation did. A write that covered only part of a reused block replaced that part. The rest could still hold the previous owner's bytes. The researchers could not choose the customer, the workload, the host, or the file, and residual data was not guaranteed to be there.

Cloudflare's counts: residual material on 18 of 24 placements, and on 20 of 22 nodes, across four continents. In six production placements, directory-block checksums attributed none of 5,614 testable blocks to the researchers' own filesystem and identified 2,700 distinct foreign directory inodes. A check against blocks the researchers had created and deleted themselves attributed all 162 of those to their test filesystem. Recovered types in the post include directory structures, database pages, and structurally complete SQLite databases. The impact line adds filesystem metadata and application data.

Accomplish's note the same day lists directory listings, SQLite databases, Chromium profiles, .env files, and credential files, and says Browser Run shares the disk. Cloudflare's post does not name Browser Run, Chromium profiles, .env files, or credential files. Keep that list on Accomplish's side.

The submission to Cloudflare contained counts, offsets, sizes, and truncated hashes, not third-party filenames, identifiers, credentials, or file contents. The researchers say they securely deleted what they recovered. That is how the bounty was handled. It is not a finding that the blocks were empty of secrets.

The wipe clock and the disclosure clock.#

The wipe clock is the package. Cloudflare's timeline, in UTC:

The report landed at 15:26 on 4 September. The incident was open, and the production setup confirmed, at 18:45. The runtime fix and its reuse test were merged at 21:27. Changes for new and live pools were merged at 22:03. Rollout started at 23:15. Rollout finished at 06:13 on 7 September, and clearing of old pool data began. The proof of concept was dead at 10:50 on 14 September. The bounty was paid at 12:52 that day. Cleanup of every pre-mitigation cached snapshot finished at 15:03 on 19 September.

New allocations zero after the rollout. Old mappings are gone only after 19 September. Those are different dates. Say both.

The disclosure clock is the public post on 24 September, five days after the last snapshot cleanup and 20 days after the report. The timeline printed in the post stops on 19 September. The days between the last disk retirement and the post are when a customer who keeps tokens on a sandbox disk did not yet have this window in writing.

The impact clock is the telemetry. Cloudflare built detection signatures from the researchers' proof and from its own reproduction, and ran them on retained disk activity. It found the researchers and its own engineers. It says it saw no evidence that anyone else used this specific method. The post does not say when the skip-wipe option was first set, and it does not say how far back the retained telemetry goes. No malicious use in the records they kept is the finding. It is not a start date for the exposure.

What this is not.#

It is not a read of a neighbor's live, still-attached disk. Cloudflare says the data came from blocks a deleted container had returned to the pool. It is not a chosen victim. The researchers did not show a write into another customer's active data, or a way to take a workload offline.

It is not the 20 September OpenAI resolver gap. Different company, different control. The shared point is only that a sandbox can fail in storage while the week's other story is a network halt.

It is not a CVE in this post. Cloudflare did not publish one. Do not mint a number for the ticket.

Accomplish calls this its sixth published sandbox escape since July, after findings in Claude Cowork, Claude Code, the Cursor command-line tool, Docker, and Codex. That is their series. This brief is the Cloudflare disk.

What to do.#

If you run agents or builds on Cloudflare Containers or Sandboxes:

1. Treat disks that existed before 15:03 UTC on 19 September as able to return residual blocks to another Workers Paid container on the same host. You cannot look up whether yours did.
2. Rotate long-lived tokens, cloud keys, and SSH material that were written onto those disks. Cloudflare is not ordering the rotation. A secret's clock is yours.
3. Stop storing registry tokens and cloud credentials on the writable root of a multi-tenant sandbox. Inject short-lived credentials at runtime from a store that is not the thin-provisioned disk.
4. If you operate a sandbox, confirm that new blocks are wiped and that cached image snapshots from the old setting were destroyed. A flag that skips wiping is a tenant boundary.
5. Split the status line. "New allocations are wiped" and "old disks are gone" are 7 September and 19 September. The public post is 24 September. Publish all three.

The Hacker News carried the post on 25 September. US trends on X the next day are football and combat sports. They are not this ticket. The ticket is a sandbox disk that outlived the setting that was supposed to wipe it.

1. 2026-09-04
   Oren Yomtov of Accomplish reports the residual-block read at 15:26 UTC. Cloudflare confirms the production setup the same afternoon and merges the runtime fix that night. Rollout starts at 23:15 UTC.
2. 2026-09-07
   Rollout of the wipe completes at 06:13 UTC. Clearing of old pool data begins. New allocations are no longer handed out dirty.
3. 2026-09-14
   Researchers report the proof of concept no longer works. Cloudflare pays the bounty the same day. Mapped disks and cached snapshots are still a separate job.
4. 2026-09-19
   Cleanup of pre-mitigation cached snapshots finishes at 15:03 UTC. Running container disks have been retired.
5. 2026-09-24
   Cloudflare posts the joint account. Customers are told no action is required. Accomplish publishes its shorter note the same day.
6. 2026-09-25
   The Hacker News carries the disclosure. The exposure window before 4 September is still not dated in the post.