Cloudflare fixed a vulnerability in its Containers service that let customers read leftover disk data from other accounts’ deleted containers on shared servers. The flaw, reported September 4 by Oren Yomtov of security firm Accomplish AI, exposed directory structures, database files, and credential data across accounts.
The problem centered on Linux thin provisioning, a storage optimization that allocates disk blocks on demand. When Cloudflare provisioned blocks for containers, the system was configured to skip wiping data before reassigning blocks to new containers. Each block held 64 kilobytes. When a new container wrote only a small amount into reused space, the remaining block still held the previous customer’s data intact.
Exploit was straightforward. Researchers wrote four kilobytes to unused space, then read the entire 64-kilobyte block back at raw disk level. The 60 kilobytes they had not written still contained bytes from another container. Across production tests, they recovered leftover material on 18 of 24 tries, each on a server Cloudflare assigned. Testing across 22 underlying machines spanning four continents found similar exposure across all regions.
Recovered data included complete SQLite databases, .env configuration files, credential files, and Chromium browser profiles. Cloudflare said researchers confirmed their analysis scripts output only counts and format checks, not file contents. Material sent to Cloudflare contained no third-party names, identifiers, credentials, or recovered content from other customers. All data was kept private and securely deleted after researchers submitted findings.
Container security has become a critical infrastructure vulnerability throughout 2026. According to the Cloud Security Alliance, Linux kernel bugs keep breaking container isolation boundaries faster than patches can roll out. Dirty COW broke containers in 2016. Leaky Vessels did the same in 2024. In 2026, copy-primitive flaws like CopyFail (CVE-2026-31431) discovered by Korean security firm Theori exploit page-cache corruption in the crypto code. That flaw shipped since 2017 and took an AI tool four months to find despite nine years of human review failing to spot it.
Cloudflare addressed the flaw in two stages. First, it reactivated block wiping for newly handed-out storage on September 14. Researchers confirmed their proof-of-concept no longer worked. However, blocks already mapped into running container disks and cached image layers still posed risk. So Cloudflare retired every running container disk and cleared all caches during quiet hours, finishing cleanup by September 19.
The disclosure timing reflects Accomplish’s expanded security research program. Oren Yomtov’s team published their sixth sandbox escape since July. Earlier findings hit Anthropic’s Claude Cowork (SharedRoot), Claude Code, Cursor, Docker, and OpenAI’s Codex.
Those escapes followed patterns: agents writing files that unsandboxed host processes later execute; permissive guest configurations paired with Linux kernel privilege escalation; writable filesystem mounts exposing entire host directories. Cloudflare’s flaw operated differently, yet reinforced the same pattern: isolation boundaries fail at infrastructure layers, not agent architecture.
For containment, Cloudflare looked for exploitation signs using disk-activity records. It built detection signatures from researchers’ proof of concept and its own independent copy of the attack. It ran signatures against retained records and found only authorized testing by researchers and Cloudflare engineers. No evidence emerged that anyone else used this method.
However, Cloudflare did not disclose how long records were retained or when the unsafe setting was first deployed, leaving exposure duration unclear.
Cloudflare Sandboxes, sold as a secure environment for running untrusted code including AI agents, was affected alongside Containers. Implications extend beyond individual accounts. Multi-tenant Kubernetes clusters, CI runners, and shared SaaS infrastructure relying on server-level isolation inherit identical exposure when underlying filesystems use thin provisioning with wiping disabled.
CopyFail showed how broadly Linux bugs can cascade across infrastructure; Cloudflare’s incident confirms that configuration choices compound the risk.
