Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second

Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers,

The report says researchers demonstrated a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token from a co-located Worker in production at up to 12 bits per second, which was significantly faster than an earlier 2021 demonstration. The article describes an end-to-end experiment using attacker and victim Workers controlled by the researchers. RealGround implication: this is a side-channel data-exfiltration issue that can affect multi-tenant AI or agent workloads running in shared execution environments, so teams should assess isolation assumptions, harden secret handling, and red-team for cross-tenant leakage paths.