Cloudflare Workers AI model returned fragments of other customers' requests in 155 responses
What happened
Cloudflare disclosed that a configuration mismatch on a hosted GLM-5.3 model on Workers AI triggered a bug in the SGLang inference engine. For very long prompts, the model could return responses built from stale cache pages that held other customers' requests. Cloudflare found no evidence of deliberate exploitation and fixed the issue the day it was declared.
Cloudflare's write-up says the GLM-5.3 model from Z.ai on Workers AI was deployed with a context window of 1,048,576 tokens while the prefill cache pool held only 681,280. Over-length requests should have been rejected. Because of a bug in SGLang's disaggregated prefill and decode mode they were marked rejected but not aborted, so the decode stage read stale cache pages holding other customers' data. Cloudflare says 155 responses to prompts longer than 681,280 tokens were affected between 27 August and 9 September 2026, and no other Workers AI model was affected. A researcher reported it through HackerOne on 8 September and Cloudflare declared the incident on 9 September.
How it happened
Leaky AI product: App flaw. A security flaw in an AI application, such as broken login or access checks, let someone reach data they should not have seen.
Sources do not say whose AI model was involved. The product was Workers AI, a type of AI-powered app.
Impact
Data was exposed. Data involved: chat logs. The impact was limited to a small number of people or a single system.
Severity is rated Low, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 27 Aug 2026. It became public on 26 Oct 2026, 60 days later.
Cloudflare set the model to private on 9 September, raised the prefill cache pool to roughly twice the context length, patched SGLang so rejected requests are retired before any cache transfer, and restored the model to public the same day. The engine fix shipped upstream in SGLang 0.5.20 to 0.5.22, and Cloudflare recommends 0.5.22 or later. It says it found no evidence of deliberate exploitation.