Cloudflare discloses AI data leak between customers on GLM-5.3 model

What happened

Cloudflare has published a report on a tenant isolation problem in its GLM-5.3 model on Workers AI. It says a small number of customers received responses containing data from other customers' requests, made to the same model shortly before theirs. ^[1] In total, 155 responses were affected, all to prompts longer than 681,280 tokens. ^[1]

The exposure ran from 27 August 2026, when the model launched, until the model was restored on 9 September. ^[1] Cloudflare says no other model hosted on Workers AI was affected. ^[1]

How it was found and fixed

A security researcher, Gadi Evron of Knostic, reported the issue through Cloudflare's HackerOne programme on 8 September. ^[1] Cloudflare reproduced it the next morning and took the model offline within 40 minutes of declaring an incident. ^[1] A corrected configuration and a patched inference engine followed, and service was restored the same day. ^[1]

After excluding its own testing and the researcher's, Cloudflare says the requests it identified were consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug. It says it found no evidence of deliberate exploitation. ^[1]

The cause, in plain terms

Cloudflare describes two overlapping problems. First, it deployed the model with a context window of 1,048,576 tokens, but the memory pool holding the model's working cache on its prefill GPUs had room for only 681,280. Cloudflare says it knew about the mismatch before launch and expected the software to return an error for any prompt it could not process. ^[1]

Second, a bug in SGLang, the open-source inference engine Cloudflare uses, meant over-length requests were not rejected cleanly. Instead, the decode stage read memory pages that still held data left by earlier requests. The result was a normal-looking reply, with a success code, containing other users' content. ^[1] Cloudflare says its tests only checked response codes and performance, not whether the output made sense, and that it now checks the pool size against context length before deployments change. ^[1]

The bug had been reported to SGLang by another user on 6 July, and the fix is in SGLang v0.5.20 and later. Cloudflare recommends operators update to v0.5.22 or later. ^[1]

What it means for businesses

If you send long documents to hosted AI models, this is a reminder that "multi-tenant" systems share hardware, and isolation depends on careful engineering. The affected prompts were very long, over 681,000 tokens, so ordinary chat use was unlikely to be involved, but long-context work such as contract review or codebase analysis is exactly where such prompts occur.

Cloudflare credits the researcher and the SGLang maintainers and says it has hardened all its disaggregated deployments. It also plans more safeguards, including tagging memory pages so a request cannot read pages it does not own, and formal verification of its transfer protocol. ^[1] The post does not say which customers were affected, and anyone who used GLM-5.3 on Workers AI during the window should check with Cloudflare directly. Teams running their own SGLang servers should apply the recommended checks and updates.

Source: Cloudflare — Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang