Shared compute platforms have become the default for many workloads, but a recent disclosure by security researchers highlights a fundamental tension in multi-tenant infrastructure: isolation is harder than it looks. Researchers have demonstrated a remote Spectre attack against serverless functions, extracting a JSON Web Token from a co-located worker at up to 12 bits per second—a significant improvement over previous proof-of-concepts.
How the Attack Works
The attack exploits speculative execution at the CPU level, a vulnerability that has haunted processor design since Spectre was disclosed in 2018. The researchers controlled both an attacker worker and a victim worker running on the same physical hardware. By carefully timing memory accesses and measuring execution delays, the attacker worker could infer the contents of memory belonging to its neighbour, even though both processes run under different isolation contexts.
The improvement in speed—360 times faster than 2021 demonstrations—matters. It means the attack moves from academic curiosity into something with practical teeth. At 12 bits per second, extracting a typical JWT token becomes feasible within minutes rather than hours or days. For an attacker, that's the difference between undetectable reconnaissance and something that logs might catch.
The Multi-Tenant Problem
Serverless platforms optimise for density and cost by packing user workloads onto shared hardware. That's the business model. But density and isolation exist in constant tension. Traditional process isolation, container boundaries, and even virtual machines all rely on the assumption that the CPU faithfully executes instructions without leaking information about internal state. Spectre broke that assumption.
The vulnerability class reveals that isolation at the software layer is incomplete. A sufficiently capable attacker running code on the same physical CPU can observe timing variations, cache contention, and memory access patterns from neighbouring processes. This is not a bug in any single implementation—it's a fundamental property of modern CPUs.
For infrastructure operators, the implications are uncomfortable. You can't patch speculative execution out of a modern processor, and you can't guarantee that users' code won't be co-located with adversarial code on the same hardware. The only defences are architectural: running fewer tenants per machine, disabling features, or accepting that some information leakage is inherent to the model.
Practical Mitigation and Detection
Cloudflare and other serverless providers have implemented various mitigations: address space layout randomisation, reduced timing resolution in APIs, and CPU affinity controls. The researchers' work shows these help but don't eliminate the risk. A determined attacker with code execution can still find side channels.
Detection is equally challenging. The attack generates minimal logs and doesn't require large data transfers. It's essentially silent timing analysis conducted from user-supplied code. Defending against it means either detecting anomalous CPU behaviour (difficult to do without impacting performance) or preventing the attack condition entirely (co-location with untrusted code).
For organisations deploying on shared serverless platforms, the question isn't whether this attack will work—research has now shown it does. The question is whether your threat model includes untrusted co-tenants and whether your secrets (JWTs, database credentials, API keys) are valuable enough to justify the attack cost.
What This Means for Hosted Infrastructure
This research underscores a crucial difference between serverless convenience and infrastructure isolation. When you rent compute by the request, you're accepting shared hardware. That trade-off makes sense for many workloads, but not for all. Workloads handling high-value secrets, authentication tokens, or data subject to regulatory requirements should consider dedicated resources—whether that's dedicated serverless instances, virtual machines on isolated hardware, or actual bare-metal infrastructure.
The faster attack speed also means the economic calculation has shifted. Previous Spectre demonstrations were slow enough that operational overhead and detection risk made them impractical. A 12-bit-per-second exfiltration is slow by network standards but fast enough to be worthwhile for extracting small, high-value secrets. Threat actors will be paying attention.
Shared infrastructure will remain the default for cost reasons, but this research is a useful reminder that density carries security trade-offs. The platform provider can't solve this problem for you. Your responsibility is understanding what you're storing, where, and what isolation guarantees the hardware actually provides.
