Cloudflare discloses Workers AI bug that leaked other users' data in 155 GLM 5.3 responses

What Cloudflare disclosed

Cloudflare published a post-mortem on 26 October 2026 about a tenant isolation failure in the GLM 5.3 model it hosts on Workers AI. GLM 5.3 is a text generation model from Z.ai built for agentic coding. Between 27 August and 9 September 2026, a small number of customers received responses that contained data from other customers' requests made to the same model shortly before theirs.

Cloudflare counts 155 affected responses, all to prompts longer than 681,280 tokens. After excluding its own tests and the researcher's, the company says the requests match ordinary long-context use in timing and volume, and that it found no evidence of deliberate exploitation. It says no other Workers AI model was affected.

How the leak happened

Cloudflare describes two overlapping faults. The first was its own configuration. It advertised GLM 5.3 with a 1,048,576-token context window, but the KV cache pool on its prefill GPUs held only 681,280 tokens. The team knew about the mismatch before launch and expected the engine to reject prompts that did not fit. Its long-context tests returned successful HTTP codes, and Cloudflare says it did not check the content of those responses.

The second fault was a bug in SGLang, the open-source inference engine, when run with separate prefill and decode GPUs. An over-length prompt was marked as rejected and swapped for a one-token placeholder, but it was not aborted. Prefill sent one page of cache to the decode node, which then generated a full reply while reading cache pages that still held earlier users' prompts and partial outputs. The client got an HTTP 200 instead of an error.

The response and the fix

Gadi Evron of Knostic reported the issue through Cloudflare's HackerOne program at 23:11 UTC on 8 September. Cloudflare declared an incident at 13:22 UTC on 9 September, made the model private at 14:00, and restored it at 19:40 with a corrected configuration and a patched engine. The prefill pool now holds about 2.04 million tokens, roughly twice the context length.

Upstream, the SGLang team at RadixArk merged fixes that reject such requests at admission, add per-transfer KV checksums and turn on deferred KV release by default. Cloudflare recommends that anyone running SGLang in disaggregated mode compare pool size with context length on every node and upgrade to v0.5.22 or later. It also notes that a similar bug had been reported to SGLang as issue #30233 on 6 July 2026.

Why it matters

Most AI security coverage in Cybersecurity is about prompt injection or model misuse. This incident is a plain infrastructure bug: shared GPU memory that is not zeroed between requests, plus an engine that failed open. Any provider that serves long-context models on shared hardware carries the same class of risk. The post-mortem says Cloudflare's tests checked status codes rather than output, which is the gap other operators can test for today. Whether Cloudflare contacted the customers whose data appeared in other responses is not stated in the announcement.

Questions people ask

How many Cloudflare Workers AI responses leaked data?

155 responses from the GLM 5.3 model between 27 August and 9 September 2026, all to prompts longer than 681,280 tokens, according to Cloudflare.

Was the Cloudflare KV cache bug exploited?

Cloudflare says it found no evidence of deliberate exploitation and that the affected requests look like ordinary long-context use.

What should SGLang operators do?

Cloudflare recommends checking KV pool size against context length on every node and upgrading SGLang to v0.5.22 or later, which rejects over-length requests before the cache handoff.

Sources

1. Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang (Cloudflare, 26 Oct 2026)