The old registry is not going anywhere
Cloudflare ships a new module registry behind a flag and commits to retiring nothing, and Wiz finds that the part of an AI gateway nobody called a vulnerability is the part that reaches the cloud credentials.
How we Build
A runtime gained a second module registry and no date for losing the first
Cloudflare has rewritten the module registry inside workerd, the core of the Workers runtime. Specifiers become real URLs, import.meta.resolve() works, and a module compiles when something first imports it rather than when the bundle is uploaded. Three of the changes would break working code if they arrived unannounced. A query string now produces a distinct module instance with its own state, and unrecognised import attributes throw where the old registry ignored them in silence. Any other attribute name is a hard error. All of it sits behind an opt-in flag, and Cloudflare writes that the existing registry is not going anywhere.
We tell a client that publishing something for other teams to call puts them on the hook to everybody downstream, and that the hook belongs in writing where those people can find it.
Every interface the team publishes carries a version and a deprecation promise.
The flag is a version. The sentence about the existing registry is a promise. Between them the condition above is met exactly, and what has been promised is that nothing will be retired. Two registries now sit in one runtime with no date on which anybody has to move off the older one. Whether that is a firmer commitment than a deprecation window or a thinner one is a genuine question, and this is one vendor’s release post about one runtime rather than a survey of how anybody else does it. Permanent coexistence may well be right for a platform carrying millions of deployed Workers. If you publish interfaces this way, or think a date is the wrong thing to ask anyone for, write to transform@dromologue.ai.
How we Assure
Nine in every hundred public AI gateways accept the password printed in the documentation
Wiz scanned 3,074 internet-facing LiteLLM deployments in February and found 294 of them accepting sk-1234, the default master key, or no credential at all. Three findings came out of reading the code behind them. An authentication bypass on the tool endpoint, now in CISA’s catalogue of exploited vulnerabilities, lets a one-character token open a session. A second path reaches root, because the endpoint that registers a guardrail skips the checks the endpoint that tests one applies. The third was given no CVE and was not fixed. Pass-through routes forward to any address, including the cloud metadata service, and they strip an x-pass- prefix on the way, which hands an attacker the token the metadata service asks for.
Our position runs the other way. Parts of a system get approved one at a time, and attacked together.
For every agent, the combination is assessed as one thing: untrusted content, private data and a path out.
Wiz describes the pass-through route as arguably working as intended, and a documented default password is documentation. Each was looked at alone. Each passed. Set beside one another they are theft of cloud credentials, before anybody authenticates. The software sits in roughly a third of cloud environments, on Wiz’s own count. That prevalence figure has no stated method behind it, so the number to carry is the scan, which states what it divided by.