In a hydrocarbon well, cement fills the annular gap between two steel casings or between a steel casing and rock formation, forming a sheath that isolates fluids in different zones of the well. For a well as long as several kilometers, the cement sheath covers a large area and inevitably contains small cracks. The cement sheath fails when a small crack grows and tunnels through the length of the well. We calculate the energy release rate at a steady-state tunneling front as a function of the width of the tunnel. So long as the maximum energy release rate is below the fracture energy of the cement, tunnels of any width will not form. This failsafe condition requires no measurement of small cracks, but depends on material properties and loading conditions. We further show that the critical load for tunneling reduces significantly if the cement/casing and cement/formation interfaces slide.