Check Point Research researchers Yarden Porat and Shahar Tal presented "When Agentic Glue Melts: Exploiting Cloudflare CodeMode and Workers" at Black Hat USA 2026 (Mandalay Bay, Las Vegas, August 6, 2026, 3:35 PM PT), detailing five memory-corruption and logic flaws in workerd, the open-source JavaScript/WebAssembly runtime that underlies both the Cloudflare Workers serverless platform and Cloudflare Code Mode (a feature that exposes Worker bindings to LLM agents as a typed TypeScript API the model writes and executes code against, rather than emitting sequential structured tool calls).

The five root causes: (1) a URLPattern out-of-bounds read caused by a nested-capture-group count mismatch between workerd's parser and V8's regex engine — a pattern such as `/(ab(cde))/` produces two capture groups in V8's regex engine but is counted as one by workerd's URLPattern group list — exploitable in both the original and Ada-backed URLPattern implementations, that yields an arbitrary-memory-read primitive by treating out-of-bounds bytes as a kj::String (pointer+size+disposer); (2) a use-after-free write in the node:zlib binding's deflateParams(), where the z_stream structure retains a stale next_out pointer after write() completes, so a subsequent params() call flushes buffered output through the dangling pointer into freed memory whose output-offset parameter allows targeting an exact field within the reused object (rated Critical by Cloudflare); (3) a use-after-free read in HTMLRewriter's AttributesIterator, which holds a raw pointer into an element's attribute array that is freed on reallocation when setAttribute() calls grow the array beyond capacity, surfacing on the iterator's next next() call (rated Critical by Cloudflare); (4) a Durable Objects SQL-authorizer bypass that validates table names in queries but not in ALTER TABLE RENAME TO, letting an attacker create a table under a permitted name, populate it with crafted bytes, and rename it into the protected _cf_KV namespace; and (5) an arbitrary-deserialization flaw reachable through that authorizer bypass, where the crafted bytes reach workerd's internal V8 deserializer, which is built for trusted input only.

Two exploit chains were demonstrated. The cross-tenant secret-theft chain deploys a malicious Worker into a shared compute pool, calls pattern.exec() on the crafted nested-group regex to trigger the URLPattern OOB read, constructs a fake kj::String from freed tcmalloc chunks to leak a real heap address, defeats ASLR by reading tcmalloc free-list "next" pointers, shapes the heap using VFS file allocations to place attacker-controlled data adjacent to target objects, and abuses in-place VFS file-content modification (no reallocation) to build a repeatable read primitive that sweeps a co-located tenant's heap for strings matching the API-token pattern `Bearer sk…`. This works because, per Cloudflare's own confirmation, the tcmalloc heap sits outside both the V8 sandbox ("cage") and hardware memory-protection keys, so a read primitive that escapes V8 isolation also escapes cross-tenant memory protection. The Code Mode sandbox-escape chain begins with prompt injection steering an LLM agent into generating attacker-controlled TypeScript that Code Mode executes; the script calls handle.write() with Z_NO_FLUSH to leave compressed data pending, then calls handle.params() to trigger deflateParams(), flushing through the stale next_out pointer into a freed slot holding FileImpl metadata; the UAF write corrupts that FileImpl's data.size field to inflate its bounds, yielding out-of-bounds file read/write that is used to corrupt a second FileImpl's data.ptr field, achieving an arbitrary process-memory read/write primitive via the second file's API; the exploit then writes ARM64 shellcode into V8's fixed RWX region at address 0xaaaaf0000000 and hijacks the zlib stream's native write-callback pointer so that a further handle.write() call redirects execution into the shellcode (Check Point's self-hosted demo used this to launch an example reverse shell). This specific RCE chain requires a self-hosted workerd compiled with the V8 sandbox disabled, which produces a single heap layout where ArrayBuffer and native objects overlap; no C2 infrastructure, persistence mechanism, or victim-scanning/reconnaissance step is described — both chains assume co-location on shared compute or a directly targeted self-hosted deployment.

Four of the five bugs (zlib UAF, HTMLRewriter UAF, both URLPattern OOB variants) were reported to Cloudflare via HackerOne on 2026-02-01; Cloudflare rated the zlib and HTMLRewriter UAFs Critical on 2026-03-11; the fifth bug (KV SQL-authorizer bypass) was reported 2026-03-12. As of public disclosure, Cloudflare had not assigned CVE identifiers to any of the five issues. Cloudflare's managed Cloudflare Workers environment was patched in production ahead of disclosure; self-hosted workerd deployments must upgrade to v1.20260619.1 (released 2026-06-19, commit 45da9a12af02ef39a1d6448139823728cf4f2cf9, PR #6822) to remediate. Check Point published five standalone proof-of-concept exploits, one per vulnerability, on GitHub (yardenporat353/WhenAgenticGlueMeltsPOCs) alongside the Black Hat presentation — each PoC directory ships a Vulnerability.md root-cause writeup, a Run.md build/execution guide, and a Dockerfile pinning the exact pre-patch vulnerable workerd build for reproducibility; the two OOB-read PoCs and the KV bypass PoC are rated High/Medium severity in the repo, while the zlib and HTMLRewriter UAF PoCs are rated Critical, matching Cloudflare's own severity assignment. The repository states the full arbitrary-deserialization exploit chain and both complete end-to-end attack chains are restricted to vetted researchers via Check Point Research directly (contact: shahartal@checkpoint.com).