Cloudflare says Workers AI bug exposed data in 155 GLM-5.3 replies

Cloudflare says a flaw in one of its hosted AI models caused some customers to get back pieces of other customers' requests. The company said on October 26, 2026, that its GLM-5.3 model on Workers AI failed to keep customers' data separate, with the trouble starting on August 27, 2026.

In all, 155 responses were affected, and every one came from a prompt longer than 681,280 tokens, Cloudflare says. Its review turned up no sign that anyone abused the flaw on purpose, and the requests matched ordinary long-context traffic in timing and volume.

Key facts

• Cloudflare counts 155 GLM-5.3 replies that carried text from someone else's request.
• The problem ran between August 27 and September 9, Cloudflare says.
• Security researcher Gadi Evron of Knostic reported it on September 8 through HackerOne.
• Cloudflare says no other model on Workers AI was affected.
• Teams running SGLang should move to version 0.5.22 or newer, Cloudflare says.

How the leak happened

Cloudflare points to two problems that combined. The first was a setup error: GLM 5.3 ran with a 1,048,576-token context window, while the KV cache pool on the prefill GPUs held only 681,280 tokens. A KV cache is working memory a model uses while it reads a prompt.

The company says it knew about the mismatch before launch, but it expected the engine to reject any prompt that was too large with an error.

The second problem was a bug in SGLang, an open-source inference engine. When prefill and decode run on separate machines, the engine swapped an over-length prompt for a one-token placeholder instead of stopping the request, Cloudflare says.

This is where the exposure began. Cloudflare says the KV cache pages are not wiped between requests, so the decode step wrote its answers using old memory that still contained earlier prompts and half-finished replies from other people.

The failure was also hard to spot. Cloudflare says affected clients received an HTTP 200 success code rather than an HTTP 400 error, and the replies read as coherent text.

Background

GLM is a text generation model from Z.ai designed for agentic coding, and it is one of many models on Workers AI. Cloudflare's model page calls GLM-5.3 Z.ai's flagship agentic coding model, with a 1,048,576-token context window. The page says it is available only on the Workers Paid plan or with prepaid AI Gateway credits.

The SGLang bug was not brand new. Cloudflare says another user had reported the same bug as issue #30233 on July 6, 2026, which the company found during its investigation.

How Cloudflare responded

The alert came from outside the company. Gadi Evron of Knostic flagged the problem on September 8, 2026, through Cloudflare's HackerOne program.

Cloudflare says it recreated the problem the following morning, and the model was offline less than 40 minutes after staff declared an incident. Its timeline shows GLM 5.3 was made private at 14:00 UTC on Sep 9, 2026, and returned to public at 19:40 UTC that day.

The fix had two parts. Cloudflare grew the prefill KV pool to about 2.04 million tokens, roughly twice the context length. It also patched the engine so rejected requests now return their original error.

In its post, Cloudflare stated: "We found no evidence of deliberate exploitation." The company says that finding came after it excluded its own testing and the researcher's testing.

What it means for you

If you used other Workers AI models, Cloudflare says you were not affected. According to the company, GLM 5.3 stood alone because each of the other split deployments has more cache space than its maximum prompt size.

The risk is wider for teams that host models on their own. Cloudflare warns that anyone running SGLang with split prefill and decode nodes could hit a similar bug.

The company also has not described what kind of data appeared in those replies.

Practical steps

• Upgrade SGLang to version 0.5.22 or a later release, as Cloudflare strongly advises.
• Check how much KV cache each prefill and decode machine really has, and cut the maximum prompt size if the cache is too small, Cloudflare says.
• To flag a Workers AI security problem, use Cloudflare's page at hackerone.com/cloudflare.

Timeline

• July 6, 2026: another user reports the same SGLang bug as issue #30233.
• August 27, 2026: the exposure on GLM-5.3 begins.
• September 8, 2026: Gadi Evron of Knostic reports the issue via HackerOne.
• September 9, 2026: the model is set to private at 14:00 UTC and made public again at 19:40 UTC.
• October 26, 2026: Cloudflare publishes its account.

What happens next

Cloudflare says it is teaming up with SGLang's developers to build checks that confirm each memory page is valid. It is also using formal verification, a math-based way to prove code is correct, on the systems that move KV cache data, the company says.

FAQ

Was any other Workers AI model affected? No. The company says its checks showed every other hosted model was safe.

Was the bug deliberately exploited? Cloudflare says its review showed no sign of intentional abuse.

Which SGLang versions contain the fix? Cloudflare says the patch shipped in SGLang v0.5.20, with follow-ups in v0.5.21 and v0.5.22.

Who found the problem? Cloudflare credits Gadi Evron of Knostic, who reported it through HackerOne.

How long did the problem last? Cloudflare says it ran from August 27 to September 9.