TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cloudflare reported that a configuration mismatch and an SGLang inference-engine bug caused 155 GLM-5.3 Workers AI responses to include data from other customers’ recent requests. The affected requests were longer than 681,280 tokens; Cloudflare says it found no evidence of deliberate exploitation, patched the engine and configuration, and restored the model on Sept. 9, 2026.
Cloudflare says a tenant-isolation flaw in its GLM-5.3 Workers AI model caused 155 responses between Aug. 27 and Sept. 9, 2026, to contain data from other customers’ recent requests to the same model. The company says the issue affected prompts longer than 681,280 tokens, that it found no evidence of deliberate exploitation, and that it patched the system before restoring the model on Sept. 9.
Cloudflare said security researcher Gadi Evron of Knostic reported the issue through its HackerOne program on Sept. 8. The company reproduced it the following morning and took the model offline within 40 minutes of declaring an incident. It then deployed a corrected configuration and a patched version of the inference engine, and returned GLM-5.3 to service on Sept. 9. Cloudflare said no other Workers AI model was affected.
The company attributed the exposure to two interacting issues involving SGLang, the open-source inference engine used to serve the model. Cloudflare had configured GLM-5.3 for a context window of up to 1,048,576 tokens, while the KV cache pool on its prefill GPUs could hold only 681,280 tokens. The service expected requests that exceeded that pool to fail safely, but a bug in SGLang’s disaggregated prefill-and-decode process instead allowed some requests to continue.
According to Cloudflare, the engine marked an over-capacity request as rejected and substituted a one-token placeholder, but still generated and transferred a KV cache. The decode node treated the transfer as complete, even though most of the cache had not been overwritten. It then generated an answer while some pages still held information from earlier requests. Cloudflare said the resulting cross-request data appeared in 155 responses; it did not publish the number of customers or the content of the exposed data in the supplied report.
What the Exposure Means for Customers
The incident involved a breakdown in isolation between customer requests, rather than a reported compromise of Workers AI as a whole. A response that includes another user’s prompt or related content could disclose information that the earlier customer submitted, depending on what was present in the retained cache. Cloudflare has not specified the sensitivity or categories of information contained in the affected responses in the report provided here.
The affected requests were unusually long, but the event matters beyond the size of the prompt threshold. The failure arose when an error path did not stop processing and stale GPU cache pages remained available to the next stage. Cloudflare’s account highlights why a service needs both configuration safeguards and engine-level checks: relying only on a pool being large enough can leave similar paths vulnerable when models or hardware settings change.
For customers, the public account establishes the affected model, dates and response count, but does not identify who received affected responses. It also does not say whether each response was delivered to a different customer or whether any particular customer has been notified. Those details would help users determine whether they need to review their own records or take further steps.
Products Worth Considering
Sony WH-1000XM4C Wireless Noise-Cancelling Headphones, Black
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Sonos Era 100 SL Compact Microphone-Free Speaker, Black
As an affiliate, we earn on qualifying purchases.
How SGLang’s Cache Path Failed
Workers AI served GLM-5.3 using a disaggregated inference setup: prefill GPUs processed a prompt and created its KV cache, then transferred that cache to decode GPUs, which generated the response. Cloudflare said the transfer used remote direct memory access through Mooncake. The cache is held in a shared pool of fixed-size GPU-memory pages, which are assigned to requests and released when processing ends.
Cloudflare’s report says those pages are not zeroed between requests; the next request is expected to overwrite the data it needs. That design is used for performance, but it makes correct request admission and cache-transfer handling important. In this incident, the pool’s capacity was below the model’s advertised context window, and the engine’s rejection path did not terminate the over-capacity request before cache transfer.
Cloudflare said the configuration mismatch was known before launch. Its long-context tests had returned successful responses, and the company expected the inference engine to return an error when a request exceeded the pool. The report says that expectation proved wrong in this specific path. Cloudflare published its account alongside a coordinated disclosure from SGLang, and said it is continuing work with upstream maintainers on this and similar bugs.
“We have remediated the issue, and we restored the model on September 9.”
— Cloudflare
What Cloudflare Has Not Disclosed
Cloudflare’s report gives the total of 155 affected responses, but the material provided does not state how many customers were involved, what information appeared in the responses, or whether all affected customers were individually notified. It also does not describe any confirmed downstream use of the exposed information. Those points should not be inferred from the response count.
The company says it found no evidence of deliberate exploitation after excluding its own testing and the researcher’s activity. That is a statement about the evidence it identified, not proof that no one could have encountered or used the flaw. The report does not provide details of the review’s methods or an independent assessment of the incident.
Cloudflare says it confirmed that other Workers AI models were not affected. The available account does not give a separate technical audit of those models or spell out whether similar failure paths have been assessed across every deployment. The report does say that Cloudflare and SGLang maintainers are working on this and similar bugs.
Further Fixes and Customer Follow-Up
Cloudflare said it increased the GLM-5.3 prefill KV pool to about 2.04 million tokens, roughly twice the model’s 1,048,576-token context length. It also patched SGLang so requests marked for rejection are stopped at the disaggregation admission queue, before bootstrap, allocation or KV transfer. The proposed upstream change also has the decode node check that the number of transferred tokens matches the number reserved.
Cloudflare said it tested the changes against the researcher’s reproduction script and its own canary-marker tests before restoring the model. The report also notes that a related SGLang fix had already been merged into the project’s main branch on Sept. 6, but had not yet been released; maintainers later merged another change intended to reject these requests earlier. The company says its work with upstream maintainers is continuing.
The next useful updates would clarify the number of customers affected, notification status and what kinds of data appeared in responses, if Cloudflare chooses to release those details. The supplied report does not announce a further release date or an additional customer-facing action.
Key Questions
What happened in the GLM-5.3 Workers AI incident?
A configuration mismatch and an SGLang bug allowed some responses to include data retained from earlier customer requests. Cloudflare says the issue affected 155 responses to prompts longer than 681,280 tokens.
When did the exposure occur?
Cloudflare says affected requests occurred from Aug. 27 through Sept. 9, 2026. The company received the researcher’s report on Sept. 8, reproduced the issue the next morning and restored the model on Sept. 9 after making changes.
Was the issue found in other Workers AI models?
Cloudflare said no other model hosted on Workers AI was affected. Its account identifies GLM-5.3, listed as @cf/zai-org/glm-5.3, as the affected model.
Does Cloudflare say someone deliberately exploited the flaw?
No. Cloudflare said the activity it identified, after excluding its own tests and the researcher’s work, was consistent in timing and volume with ordinary long-context use, and that it found no evidence of deliberate exploitation. That wording describes the company’s findings and does not establish that exploitation was impossible.
What remains unknown about the affected responses?
The report provided here does not say how many customers were involved, what specific information appeared in the responses, or whether all affected customers received individual notifications. It also does not report any confirmed downstream use of the data.
Source: hn
