Cloudflare published a revisit of remote Spectre attacks on Workers on 19 Aug 2026. Shared edge, many tenants, speculative execution that still does not care about your business logic. They describe mitigations. I believe the engineering. I do not believe "we are on Workers, so isolation is solved."
Here is the thread I cannot close from a blog post: whether your specific Worker, with your specific timing, leaks anything a neighbor can use. That answer lives in their runtime and your traffic, not in my paragraph.
What we watch anyway
Who can deploy to the account. Whether preview URLs are public. Whether secrets are bound per environment or copied from a screenshot. Whether you log enough to see a noisy neighbor probe. Managed security services on an edge app is boring on purpose: deploy anomalies, auth failures, sudden CPU, new routes.
AWS Security, same calendar day, wrote about propagating user authorization context through Bedrock AgentCore. Different product. Same class of mistake: the agent becomes a confused deputy that can read any Dynamo table because you trusted the prompt. Pass the caller's identity into the tool path. Do not invent a superuser for the model.
Token hygiene on GitHub is the sibling habit. Revoke the stolen PAT, leave the deploy keys. Edge isolation is the same inventory, different vendor.
What we will not sell
A "Spectre-proof architecture" certificate. If someone offers you one, keep your wallet shut.
We will instrument the Workers account and the agent IAM path so a tenant-crossing surprise shows up as a ticket, not a postmortem. Request a quote if the current plan is "Cloudflare handles that."
I still want a public, reproducible remote Spectre demo against a current Workers isolate before I overfit this post. Until then, treat shared metal as shared. Watch it.
Sources
- A revisit of remote Spectre attacks on Cloudflare Workers — Cloudflare, 19 Aug 2026
- Propagate user authorization context in AI agents with Amazon Bedrock AgentCore — AWS Security Blog, 19 Aug 2026
Comments