Cloudflare says its AI service leaked data between customers for almost two weeks
A flaw in Cloudflare's Workers AI sent data from one customer's requests to other customers in 155 responses from the GLM 5.3 model. It lasted from August 27 to September 9.
Cloudflare says its AI service Workers AI spent almost two weeks sending data from one customer's requests to other customers. The flaw affected the GLM 5.3 language model and caused 155 responses to contain text from other users' sessions. The company published its report on the evening of Monday, October 26, almost seven weeks after the flaw was fixed.
The case highlights a risk many organisations overlook when they buy AI as a cloud service: models run on shared hardware, and isolation between customers is only as good as the software that manages it.
What happened
According to Cloudflare, the flaw was present from the day GLM 5.3 launched on Workers AI on August 27. It was only discovered when security researcher Gadi Evron of Knostic reported it through Cloudflare's bug bounty programme on HackerOne on September 8.
Cloudflare writes that it reproduced the leak with two independent accounts, took the model offline the next day and restored it the same evening with a corrected configuration. Between August 27 and September 9, "a small number of customers" received responses containing data from other customers' requests to the same model, made shortly before theirs.
All 155 affected responses involved very long prompts of more than 681,280 tokens. After excluding its own testing and the researcher's, Cloudflare says the traffic matches ordinary long-context use rather than deliberate exploitation. "We found no evidence of deliberate exploitation," the company writes. The post does not say whether affected customers were notified directly.
Two bugs that collided
Cloudflare describes two overlapping problems. The first was a misconfiguration on Cloudflare's side. The memory pool meant to hold the model's KV cache on the servers had room for 681,280 tokens, while the model's context window is 1,048,576 tokens. The company writes that it knew about the mismatch but assumed the software handled it. Its tests only checked that responses came back without an error code, not what the responses contained.
The second was a bug in SGLang, the open-source software Cloudflare uses to serve the model. A prompt that was too long should have been rejected. In Cloudflare's setup, where one group of GPUs processes the prompt and another generates the answer, it was passed on instead. The server generating the answer then read memory pages that still held remnants of earlier users' prompts and responses. The customer received HTTP 200 and a coherent answer, not an error.
According to Cloudflare, the SGLang bug had already been reported by another user in July. The fix shipped in SGLang version 0.5.20, with follow-ups in 0.5.21 and 0.5.22. Cloudflare recommends that everyone running SGLang update to 0.5.22 or later.
What Cloudflare has changed
The company says GLM 5.3 was the only affected model on Workers AI. Cloudflare has enlarged the memory pool so it holds the full context window, added its own patch to the software and introduced a check that compares pool size with context length before every production change. It also says it will apply formal verification, mathematical proof that the system behaves correctly, to the way the cache is transferred between servers.
What leaders should take away
AI models shared between many customers are not automatically isolated from each other. Ask your provider how customer data is separated during inference itself, not just in storage and networking, and which software they build on.
Contracts and data processing agreements should state when and how you will be notified of incidents like this. In this case, almost seven weeks passed between the fix and the public report.
Organisations that run open models with SGLang themselves should check their version. Cloudflare writes that this class of bug is not new, and that similar memory bugs can put one user's data in another user's response without any error being raised.
Sources and media
Cloudflare's post was published on October 26, 2026 at 23:01 Oslo time. All figures, times and quotes in this article come from that post.
Illustration: AI-generated with Grok Bot / hogby.ai
