diff --git a/packages/at-run/runner/src/index.ts b/packages/at-run/runner/src/index.ts
index 0446e68..dac5d7b 100644
--- a/packages/at-run/runner/src/index.ts
+++ b/packages/at-run/runner/src/index.ts
@@ -394,6 +394,8 @@ async function executeEndpoint(ctx: ExecuteContext): Promise<Response> {
 
     if (result instanceof Response) {
       // Ensure CORS headers are present on sandbox responses
+      // Must clone body since streams can only be read once
+      const body = await result.arrayBuffer()
       const headers = new Headers(result.headers)
       if (!headers.has("Access-Control-Allow-Origin")) {
         headers.set("Access-Control-Allow-Origin", "*")
@@ -404,7 +406,7 @@ async function executeEndpoint(ctx: ExecuteContext): Promise<Response> {
       if (!headers.has("Access-Control-Allow-Headers")) {
         headers.set("Access-Control-Allow-Headers", "Content-Type")
       }
-      return new Response(result.body, {
+      return new Response(body, {
         status: result.status,
         statusText: result.statusText,
         headers,
@@ -442,6 +444,8 @@ async function executeEndpoint(ctx: ExecuteContext): Promise<Response> {
     const result = await endpoint.handler(validatedArgs)
     if (result instanceof Response) {
       // Ensure CORS headers are present
+      // Must clone body since streams can only be read once
+      const body = await result.arrayBuffer()
       const headers = new Headers(result.headers)
       if (!headers.has("Access-Control-Allow-Origin")) {
         headers.set("Access-Control-Allow-Origin", "*")
@@ -452,7 +456,7 @@ async function executeEndpoint(ctx: ExecuteContext): Promise<Response> {
       if (!headers.has("Access-Control-Allow-Headers")) {
         headers.set("Access-Control-Allow-Headers", "Content-Type")
       }
-      return new Response(result.body, {
+      return new Response(body, {
         status: result.status,
         statusText: result.statusText,
         headers,