Cloudflare disclosed a cross-tenant sandbox leak the day after its stock hit a record $353

Sixty kilobytes nobody wiped

A day after Cloudflare stock touched an all-time high of $353.04, the company published a disclosure↗ about the sandbox products at the center of its AI pitch ¹². Oren Yomtov of Accomplish had reported the issue through HackerOne on 4 September: with a Workers Paid account, he could recover disk blocks that other customers' containers had used and surrendered on the same host ¹.

The cause was one setting. Container root disks use Linux thin provisioning in 64 KiB blocks, and the shared pool ran with skip_block_zeroing, so a recycled block reached the next tenant unwiped ¹. Write 4 KiB into such a block and read it back raw: the other 60 KiB still held the previous occupant's bytes ¹.

2,700 directory inodes that were not theirs

In the six placements where they counted, the researchers examined 5,614 testable directory blocks, attributed zero to their own filesystem, and identified 2,700 distinct foreign directory inodes ¹. Across every placement, residual material surfaced on 18 of 24 and on 20 of 22 underlying nodes, across four continents ¹³. Cloudflare confirms directory structures, database pages and structurally complete SQLite databases; the researchers' write-up adds Chromium profiles, .env files and credential files, and describes them as other customers' files ¹³⁴.

No evidence, no action, no window

Cloudflare built detections from the proof of concept, ran them over the disk-I/O telemetry it retains, and saw only the researchers' and its own engineers' authorized testing; customers need do nothing, it says ¹. The post never says when skip_block_zeroing first shipped↗, so the exposure window is unknown ³.

The researchers say the same disk setup affected Browser Run (formerly Browser Rendering)↗, a product Cloudflare's post does not name ³⁴⁹. That is one more surface in scope for tenants weighing rotation of credentials that ran through it, against a platform whose answer is that its telemetry settles the question ¹³.

The product is the rally

The affected line is the one the market is paying up for. Cloudflare sells its Sandbox SDK as the way to "run untrusted code securely,"↗ with tutorials for running Claude Code, Codex, Cursor Cloud Agents and Devin on it ⁵.

Quarterly revenue reached $696M in Q2 2026, up 36% ⁶⁷. The rally that peaked at $353.04 put the market cap at $125 billion, up 78% on the year, with UBS at a $350 target and TD Cowen at $355↗ ². A week earlier the shares traded near $300, an intrinsic-value estimate of $189 underneath them ⁷.

Escape number six

Accomplish counts this as its sixth sandbox escape since July, after Claude Cowork, Claude Code, Cursor's CLI, Docker and OpenAI's Codex ³; the Codex pair was reported on 12 August and patched inside eight days↗ ⁸. Nothing in the record ties the streak to the multiple, and nothing rules it out either. Watch whether escape number six changes anything the fifth did not. Cloudflare is selling the safe room for AI code, and this month the floor was recycled.