Nothing escaped — a container was handed a 64 KiB block with the last tenant's bytes still in it, and the duty that fires is documentation, not notification

Cloudflare disclosed on 24 September 2026 that thin-provisioned storage with skip_block_zeroing returned deleted 64 KiB blocks to a shared pool unwiped, so a new container could read bytes it had never written; researchers saw residual material on 18 of 24 placements and 20 of 22 nodes and recovered structurally complete SQLite databases. Cloudflare Sandboxes are built on Containers, so this is the substrate a lot of agent-generated code runs on. Nothing escaped the container — execution isolation held and storage isolation was never there — and remediation required nothing of customers. For security that is true. For GDPR it is not: Article 33(5) makes the controller document any personal data breach, including the ones it decides not to notify, and that documentation must let a supervisory authority verify the decision. The facts needed to write it sit with the processor, and Article 28(3)(f) bounds the assistance owed to the information available to the processor.

Post

A researcher wrote four kilobytes into free space and read back sixty that were not his.

The storage underneath was doing exactly what it had been configured to do.

On 24 September Cloudflare published its account of a cross-tenant data exposure in Containers — the service its own Sandboxes are built on, where a lot of us run agent-generated code.

Flat:

Oren Yomtov of Accomplish reported it through HackerOne on 4 September at 15:26 UTC. Cloudflare confirmed the production flaw at 18:45, merged a runtime fix at 21:27 the same day, completed the rollout on 7 September, and cleared the last cached snapshots on 19 September.
The numbers, against an isolation model that predicts zero: residual material on 18 of 24 placements and 20 of 22 underlying nodes across four continents, and 2,700 distinct foreign directory inodes identified by checksum. What came back: directory structures, database pages, structurally complete SQLite databases.
Before you file this as a container escape: nothing escaped. Thin-provisioned pools with skip_block_zeroing returned deleted 64 KiB blocks to a shared pool without wiping them. A 4 KiB write into ext4 free space claimed a previously used block, the remaining bytes still the last tenant's. Execution isolation held. Storage isolation was never there to hold. The prerequisite was a paid Workers account, not an exploit chain.
Cloudflare says remediation "does not require any further action by Cloudflare customers". For security that is true, and six hours from report to merge deserves saying — but if anything personal sat in that sandbox, you are the controller. GDPR Article 33(5) makes you document any personal data breach, its effects and the remedial action, and that documentation has to let a supervisory authority verify your compliance, including your decision not to notify. Article 28(3)(f) obliges your processor to assist, "taking into account the nature of processing and the information available to the processor". Neither Cloudflare's post nor the coverage says individual tenants were told which placements were theirs.

My Monday: list which sandboxes ran on Containers before 7 September and what they persisted. Ask, in writing, under 28(3)(f). Then write the memo either way, because the one you never send is the one Article 33(5) is about.

Isolation you can verify is a boundary. Isolation you are told about is a claim.

Which of yours can you show?

#AgenticAI #GDPR #CloudSecurity #AIGovernance #DevSecOps

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources, the provider's own write-up first.

Cloudflare's post-incident account — the timeline, the thin-provisioning mechanism, the 18-of-24 and 2,700-inode findings, and the sentence that no further customer action is required: https://blog.cloudflare.com/containers-cross-tenant-vulnerability/

BleepingComputer's independent write-up, including Cloudflare's line on blocks returning to a pool serving multiple accounts: https://www.bleepingcomputer.com/news/security/cloudflare-fixes-containers-cross-tenant-flaw-exposing-customer-data/

GDPR Article 33 — read paragraph 5 for the documentation duty and paragraph 2 for the processor's own clock: https://gdpr-info.eu/art-33-gdpr/

GDPR Article 28 — (3)(f) for the assistance duty, (3)(h) for the audit and information rights you have to invoke in writing: https://gdpr-info.eu/art-28-gdpr/

GDPR Article 4 — definition (12), where "unauthorised disclosure of, or access to" does not ask whether anybody read it: https://gdpr-info.eu/art-4-gdpr/

GDPR Article 32 — the confidentiality and resilience measures a shared block pool is measured against: https://gdpr-info.eu/art-32-gdpr/

GDPR Article 5 — paragraph 2, accountability: you have to be able to demonstrate it, not merely have done it: https://gdpr-info.eu/art-5-gdpr/

One point I cut for length: whether this was a personal data breach at all turns on whether the residual bytes were personal data — and that is precisely the fact no tenant can establish from evidence they hold. Article 33(5) does not accept that as an answer. It asks for the assessment, not the certainty.

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

Claims

Sources

Corrections

None.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.

Nothing escaped — a container was handed a 64 KiB block with the last tenant's bytes still in it, and the duty that fires is documentation, not notification

Cloudflare disclosed on 24 September 2026 that thin-provisioned storage with skip_block_zeroing returned deleted 64 KiB blocks to a shared pool unwiped, so a new container could read bytes it had never written; researchers saw residual material on 18 of 24 placements and 20 of 22 nodes and recovered structurally complete SQLite databases. Cloudflare Sandboxes are built on Containers, so this is the substrate a lot of agent-generated code runs on. Nothing escaped the container — execution isolation held and storage isolation was never there — and remediation required nothing of customers. For security that is true. For GDPR it is not: Article 33(5) makes the controller document any personal data breach, including the ones it decides not to notify, and that documentation must let a supervisory authority verify the decision. The facts needed to write it sit with the processor, and Article 28(3)(f) bounds the assistance owed to the information available to the processor.

Post

A researcher wrote four kilobytes into free space and read back sixty that were not his.

The storage underneath was doing exactly what it had been configured to do.

On 24 September Cloudflare published its account of a cross-tenant data exposure in Containers — the service its own Sandboxes are built on, where a lot of us run agent-generated code.

Flat:

Oren Yomtov of Accomplish reported it through HackerOne on 4 September at 15:26 UTC. Cloudflare confirmed the production flaw at 18:45, merged a runtime fix at 21:27 the same day, completed the rollout on 7 September, and cleared the last cached snapshots on 19 September.
The numbers, against an isolation model that predicts zero: residual material on 18 of 24 placements and 20 of 22 underlying nodes across four continents, and 2,700 distinct foreign directory inodes identified by checksum. What came back: directory structures, database pages, structurally complete SQLite databases.
Before you file this as a container escape: nothing escaped. Thin-provisioned pools with skip_block_zeroing returned deleted 64 KiB blocks to a shared pool without wiping them. A 4 KiB write into ext4 free space claimed a previously used block, the remaining bytes still the last tenant's. Execution isolation held. Storage isolation was never there to hold. The prerequisite was a paid Workers account, not an exploit chain.
Cloudflare says remediation "does not require any further action by Cloudflare customers". For security that is true, and six hours from report to merge deserves saying — but if anything personal sat in that sandbox, you are the controller. GDPR Article 33(5) makes you document any personal data breach, its effects and the remedial action, and that documentation has to let a supervisory authority verify your compliance, including your decision not to notify. Article 28(3)(f) obliges your processor to assist, "taking into account the nature of processing and the information available to the processor". Neither Cloudflare's post nor the coverage says individual tenants were told which placements were theirs.

Isolation you can verify is a boundary. Isolation you are told about is a claim.

Which of yours can you show?

#AgenticAI #GDPR #CloudSecurity #AIGovernance #DevSecOps

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources, the provider's own write-up first.

GDPR Article 33 — read paragraph 5 for the documentation duty and paragraph 2 for the processor's own clock: https://gdpr-info.eu/art-33-gdpr/

GDPR Article 28 — (3)(f) for the assistance duty, (3)(h) for the audit and information rights you have to invoke in writing: https://gdpr-info.eu/art-28-gdpr/

GDPR Article 4 — definition (12), where "unauthorised disclosure of, or access to" does not ask whether anybody read it: https://gdpr-info.eu/art-4-gdpr/

GDPR Article 32 — the confidentiality and resilience measures a shared block pool is measured against: https://gdpr-info.eu/art-32-gdpr/

GDPR Article 5 — paragraph 2, accountability: you have to be able to demonstrate it, not merely have done it: https://gdpr-info.eu/art-5-gdpr/

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.