Cloudflare Workers AI Bug Leaked 155 GLM-5.3 Responses Between Customers

Cloudflare Workers AI sent 155 responses to the wrong place this summer. According to a disclosure Cloudflare published on October 26, some answers from the GLM-5.3 model on its Workers AI platform contained pieces of other customers' requests made to the same model shortly before. The window ran from August 27 to September 9, 2026, and every affected response came from a prompt longer than 681,280 tokens.

Cloudflare says it found no evidence that anyone exploited the flaw on purpose, and that no other Workers AI model was affected. Still, the write-up is one of the most detailed public accounts so far of how a shared AI inference service can leak data between tenants. The cause was two ordinary mistakes stacked on top of each other.

A context window bigger than the memory behind it

Large language models keep a working memory of each prompt, called a KV cache. Cloudflare runs GLM-5.3 on SGLang, an open source serving engine, in a split setup: one group of machines reads the prompt (the prefill stage) and another writes the answer (the decode stage).

The first mistake was sizing. Cloudflare offered the model with a context window of 1,048,576 tokens, but the prefill cache pool could only hold 681,280 tokens. A very long prompt simply did not fit.

The second mistake lived inside SGLang. In this split mode, a request too big for the pool was marked as rejected but still let through. The prefill side passed cache pages to the decode side anyway, and the decode side read pages that still held data from earlier requests, because pages are not wiped between jobs. The customer got a normal HTTP 200 reply instead of an error, with someone else's context mixed into the output.

Cloudflare also admitted a testing gap. Its checks looked at status codes and speed, not at whether answers were actually correct at very long context lengths.

How the GLM-5.3 leak unfolded, date by date

The entries below come from Cloudflare's post. Times are UTC.

• August 27, 2026: GLM-5.3 goes live on Workers AI with the undersized prefill pool.
• September 8, 23:11: Gadi Evron of security firm Knostic reports the problem through Cloudflare's HackerOne bug bounty program.
• September 9, 13:22: after declaring an incident, Cloudflare engineers reproduce the leak.
• September 9, 14:00: the model is switched to private and starts returning HTTP 400 errors.
• September 9, 14:35: the root cause is identified.
• September 9, 19:04: a full rebuild is finished, and public access returns at 19:40.
• September 10: Cloudflare meets with the SGLang maintainers.
• October 2: SGLang v0.5.21 ships, followed by v0.5.22 on October 19.
• October 26: coordinated public disclosure.

Unite.AI, which covered the disclosure, notes that a related SGLang issue (#30233) had been filed by another user back on July 6. It also reports that Cloudflare's status page logged the September 9 incident from 10:25 a.m. to 4:09 p.m. EDT.

Two fixes, and the work still in progress

Cloudflare's first change was blunt. It enlarged the prefill pool to about 2.04 million tokens, close to twice the context window. In the company's words, "A prompt that fits the context window now always fits the pool, so the rejection path is never reached for a valid request."

The second fix went into SGLang itself. Rejected requests are now retired at admission, before any cache data moves between machines. Cloudflare sent the patch upstream as SGLang pull requests #36988 and #38935, so other operators benefit too.

On top of that, the company added deferred cache release, capped transfer batch sizes, load balancer changes and deployment checks. It says checksums on every transfer and formal verification of the cache transfer path are still being built.

Who should check their own systems

For most Workers AI customers, there is nothing to click. Cloudflare's post gives end users no specific steps, and it does not say how affected customers were told. If your app sent GLM-5.3 prompts longer than roughly 680,000 tokens between August 27 and September 9, it is worth reviewing what those outputs contained and where they were stored, since they may hold text that was never yours. The reverse also applies: very long prompts with sensitive material sent during that window could, in theory, have surfaced in someone else's answer.

The larger audience is teams running SGLang themselves in disaggregated mode. Cloudflare recommends they compare KV pool size with context length, upgrade to SGLang v0.5.22 or later, turn on deferred KV release, enable corruption detection where the model supports it, and stop client disconnects from cancelling requests in the middle of a transfer.

The incident joins a run of AI tooling problems this month, from poisoned AGENTS.md files aimed at coding agents to Meta Muse shared chats that were left exposed. It also lands while cloud providers are racing to add inference capacity, with Amazon saying AWS capacity is sold out into 2027. More of our security coverage lives on the tech page, including the recent PHP2Shell flaws.

The lesson Cloudflare drew is narrow but useful: an AI service can return a perfectly healthy 200 and still hand back the wrong thing. Expect more providers to start testing what their models say, not just whether they answer.