Our latest sandbox escape points to a broader pattern: isolation can fail in many ways.
Our research team found a disk isolation bug in Cloudflare Containers that let a sandbox read other customers’ files: directory listings, SQLite databases, Chromium profiles, .env files, and credential files.
Cloudflare Sandboxes and Browser Run use the same disk implementation and were affected too. We reported it to Cloudflare on September 4, 2026, and they fixed it shortly after.
We worked with Cloudflare on a joint write-up of the vulnerability, the root cause, and the fix. Read the full technical breakdown on the Cloudflare blog.
This is the sixth sandbox escape our team has published since July 2026, after SharedRoot (Claude Cowork), Beltdown (Claude Code), Beltdown2 (Cursor CLI), Docker’s VMM, and OpenAI Codex’s sandbox.