Source profile
blog.cloudflare.com
A field appears only when the current profile revision carries supporting evidence. Missing context stays visibly unknown.
Scope customization makes optional permissions deselectable at authorization time. It is opt-in, but once you opt in, the token you get may be smaller than the token you asked for.
Reality
An internal proof-of-concept leaked up to 12 bit/s at 99 percent accuracy inside production Workers by exploiting a limitation in Dynamic Process Isolation. Cloudflare says the gap is now closed.
Reality
Cloudflare says its RFC 9234 tracking found two large Tier-1 networks removing the Only to Customer attribute from routes they forward, blanking the leak signal for everyone behind them.
Reality
The Agents SDK now carries durable execution, sandboxed code execution and a durable filesystem. Cloudflare's argument is that harnesses cannot own those problems, which makes them a platform decision.
Reality
Access policies can now attach to a single Worker or to an entire account. That turns internal app security into a settings toggle rather than something each developer has to remember.
Reality