Reported in February. Fixed in June. I Found Out in August.

Almost every MCP write-up blurs two different things — including one of mine. Deferring a tool definition and executing model-written code are not the same decision. Only one of them has a sandbox in it.

February 1st: four vulnerabilities in the runtime behind Cloudflare's Code Mode are reported through HackerOne.

March 11th: Cloudflare rates two of them Critical.

June 19th: the public fix ships.

August 5th: the whole thing goes on stage at Black Hat.

August 9th: I publish an article about MCP architecture, having heard none of it.

That last line is the one I want to talk about, and not because that sentence was wrong. It wasn't. My piece was about what tool definitions cost in tokens, and its recommendation — defer loading them until something needs them — is untouched by any of this. What I did was gesture at the heavier version of the fix, the one where the model writes code instead of picking from a menu, and move on without asking what runs that code.

The public fix had shipped seven weeks before I wrote the sentence. I still didn't know the question existed.

What the paper actually found

On 7 August, Check Point Research published When Agentic Glue Melts. Yarden Porat and colleagues set out to break Cloudflare's Code Mode and broke Cloudflare Workers on the way, because both sit on the same runtime: workerd.

Five vulnerabilities. Four are memory-safety bugs in the native C++ layer that hands data to untrusted JavaScript; the fifth is an authorizer bypass in the SQL layer. (The paper's summary line rounds all five to "memory-corruption bugs"; its own enumeration doesn't.) Cloudflare rated two of them Critical — a use-after-free in node:zlib and another in HTMLRewriter — and Cloudflare confirmed the bugs reproduce in production, with one exception.

Two were chained into working attacks:

• A cross-tenant heap read. An out-of-bounds read in URLPattern lets one Worker reach across a shared process heap toward another tenant's secrets.

• A sandbox escape that begins with a prompt injection. The node:zlib use-after-free breaks out and runs native code.

The second one is the interesting shape. Prompt injection is the cheapest input in this entire field. Here it is step one of a chain whose last step is native code.

Check Point's own conclusion is the line worth keeping: "The engine is not the whole boundary. Hardening V8 and shipping the cage is necessary, not sufficient."

That sentence is doing more work than it looks like. None of the four memory-safety bugs are in V8. They are in the native APIs that workerd hands to untrusted JavaScript — the glue, not the engine. The boundary was never V8 alone. It is V8 plus every native surface reachable from the code your model just wrote.

Four cracks in one paper, and not one of them in the part everybody trusts.

Deferring is not executing

Here is the distinction the genre blurs, and I blurred it too.

Progressive discovery changes when a tool definition enters the context window. It is a scheduling decision. Get it wrong, and you have a bigger prompt.

Code mode changes who runs the code. It is an architectural decision. Get it wrong and something else entirely happens.

Almost every piece written about MCP context bloat this year — mine included — presents these as two intensities of the same idea. They are not. One is a caching strategy. The other introduces an execution environment into your stack, and an execution environment has a boundary, and boundaries are things that can be crossed.

If your client defers loading definitions, nothing in this paper touches you.

If your server hands the model somewhere to run code, you have taken on a boundary — and you should know how many layers it actually has.

The part where I argue against myself

I drafted a version of this that said code mode created an attack chain that didn't exist before. Someone who does this for a living took it apart, correctly.

Most MCP servers run over stdio, as local subprocesses, with your full user privileges and no sandbox by default. If your agent's catalogue includes a shell tool or filesystem write — which describes most coding agents — then your worst case was already arbitrary code execution on your own machine, reachable with zero memory-corruption bugs.

Against that baseline, model-written code inside a properly configured isolate is plausibly safer. Cloudflare's Code Mode documents outbound network calls blocked by default, no filesystem, no host credentials handed to the generated code. Those restrictions are real, and they hold right up until the isolate doesn't.

The exfiltration path didn't need code mode either. Private data, untrusted content, and an outbound channel in the same agent is enough — what Simon Willison named the lethal trifecta — and that has been demonstrated repeatedly against ordinary tool-calling assistants.

So the chain existed. Code mode made it shorter and moved where it terminates: from your machine to somebody else's. That's the honest claim, and it's smaller than the one I wanted to make.

Count your boundaries

This is the question I should have asked in August and didn't.

A bare self-hosted workerd is one software boundary. Cloudflare's managed platform is not — their published security model describes a second layer using Linux namespaces and seccomp with no filesystem or network access, plus separation of workloads by trust level. That distinction is the whole ballgame, and it is exactly the distinction that disappears when a vendor post and a self-hosted deployment both use the word "sandbox."

Check Point tested the one-boundary configuration. That is also the one you get by default when you decide to run this yourself.

What actually changed

Not "code mode is dangerous." What changed is the price of a sentence everybody skipped.

The vendor posts that popularised this pattern did say to run the code somewhere safe. Anthropic said running model-written code requires a secure execution environment with sandboxing, resource limits, and monitoring. Cloudflare described a sandbox with the network switched off. That guidance was there.

It just arrived attached to numbers — 98.7% fewer tokens in Anthropic's example, 99.9% in Cloudflare's — and the numbers travelled and the sentence didn't. For the best part of a year, the industry has been quoting one half of a trade.

The token math was measurable, published, reproducible. I reproduced a version of it myself: one server's tool list cost 17,502 tokens, and sixteen servers came to 52,090 before anyone typed a word. Numbers like that move architecture decisions fast.

The security half had no number attached — until now, and the number turned out to be four memory-safety bugs in a C++ layer almost nobody choosing this pattern has ever looked at.

What I'd do on Monday

If you run on managed Workers: nothing technical — you were patched in June. But put one sentence in your risk register acknowledging that your agent's isolation depends on a runtime you don't control and a disclosure process you don't watch. That isn't a criticism. It's just true, and it should be written down somewhere.

If you self-host workerd or Code Mode: you want v1.20260619.1 or later. The proof-of-concept is public now.

If you're choosing an architecture this quarter: ask how many boundaries sit between model-written code and your host, and make someone name them out loud. An in-process isolate and a hypervisor are both called "sandboxes" in marketing copy and are not remotely the same guarantee. Ask what else lives in that process. Ask what happens when the isolate fails, not whether.

If you're building a server: two tools is not automatically the sophisticated choice. A curated tool surface is a smaller attack surface, and for most services it is also a better interface. Reach for code execution when the catalogue is genuinely unmanageable — not because it is the fashionable shape.

What would change my mind?

If the next twelve months bring more memory-safety breaks in the same class — same layer, different runtime — then a single in-process boundary is the wrong answer for hostile model output, and the pattern needs an OS-level one with the cost that implies. If they don't, I have over-weighted one excellent paper, and I will say so here.

Either way, the thing I would fix isn't the architecture. It's that a Critical rating in March reached me in August, through a conference talk I didn't attend, four days late.

You can keep the glass. Just stop calling it a wall.

Sources: Check Point Research, "When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers," Yarden Porat and colleagues, 7 August 2026 — disclosure timeline, vulnerability details, and quotation from the paper. Cloudflare's Workers security model and Code Mode documentation for the isolation layers. Token figures are the author's own measurements, 9 August 2026.