Cloudflare Says One of Its Hosted AI Models Returned Other People's Data
Cloudflare said 155 responses from the GLM-5.3 language model on its Workers AI service contained data belonging to other customers. The company's incident report, published Oct. 26, 2026, says the exposure was present from the model's launch on Aug. 27, 2026, until it was fixed on Sept. 9, 2026, and that no other model hosted on Workers AI was affected.
Cloudflare published the report as a coordinated disclosure alongside the maintainers of SGLang, the open-source inference engine it runs for the model. It closes with two instructions for other operators running the same setup: measure the cache pool against the advertised context length on every node, and upgrade to SGLang v0.5.22 or later.
Cloudflare traced the fault to two overlapping problems. It had deployed the model with a 1,048,576-token context window while the cache pool on the machines that process prompts held only 681,280 tokens. The company says it was aware of the mismatch before launch and had expected the engine to turn it into an error.
SGLang instead marked an over-length prompt as rejected, built a cache for a one-token stand-in, and passed it to the next stage as though the full prompt had been processed. The reply was then written over memory pages that still held data from earlier requests. "In total, 155 responses were affected, all to prompts longer than 681,280 tokens," the report says.
The report says GLM-5.3 was the only model affected because every other deployment of this kind on Workers AI has a cache pool larger than its context length. It also says the same bug had already been reported to SGLang by another user in July 2026.
Cloudflare says that after excluding its own testing and the researcher's, the affected requests match ordinary long-context use rather than repeated probing, and that it found no evidence of deliberate exploitation. That finding rests on the company's own logs. The report credits the discovery to Gadi Evron of Knostic, who reported it through Cloudflare's HackerOne bug bounty program.
