Cloudflare has confirmed that a bug in its Workers AI service handed some users pieces of other customers’ requests. According to the company’s post-incident write-up on the Cloudflare blog, 155 responses from the GLM 5.3 model were affected between August 27 and September 9, 2026, and every one of them involved a prompt longer than 681,280 tokens.
The Cloudflare GLM-5.3 data leak is small in raw count and large in implication. Cloudflare says no other model hosted on Workers AI was touched, so this was not a platform-wide failure. Still, the affected responses contained data from other customers’ requests to the same model made shortly beforehand, which is exactly the outcome that multi-tenant AI platforms promise never to produce.
Cloud teams have spent much of October absorbing provider-side incidents, from the TiDB Cloud breach that ran 28 days on a stolen service account to a steady drip of supply-chain scares. This one differs in kind. Nobody stole a credential. A configuration mismatch inside a model deployment woke up a bug in the inference engine, and the engine did the rest on its own.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Cloudflare Disclosed About the GLM-5.3 Leak
Cloudflare runs Workers AI as a serverless inference service. Customers call hosted models over an API and never touch the GPUs underneath. In this incident the model was GLM 5.3, which Z.ai supplies (secondary coverage also writes the name as GLM-5.3). The company’s disclosure ties the problem to that single model and to a narrow band of unusually long prompts.
The core facts are short. Between August 27 and September 9, 2026, 155 responses carried content that belonged to other customers’ earlier requests. Cloudflare pulled the model, fixed it, and restored GLM 5.3 on September 9, 2026. That makes the exposure window roughly two weeks, a point DEV Community coverage leads with in its headline.
Outlets from OneSignalDesk to news.lavx.hu and Turkmenportal picked up the story, and they agree on the headline numbers. Where they differ is emphasis. Some stress the privacy angle, others the engineering lesson. Both readings are fair, and this article covers each.
Key Facts and Timeline at a Glance
The table below collects what Cloudflare and the secondary coverage confirm. Items that nobody has confirmed appear in a later section, not here.
| Item | Confirmed detail |
|---|---|
| Platform | Cloudflare Workers AI |
| Affected model | GLM 5.3 (also written GLM-5.3), supplied by Z.ai |
| Exposure window | August 27 to September 9, 2026 |
| Affected responses | 155 |
| Trigger condition | Prompt longer than 681,280 tokens |
| Nature of exposure | Data from other customers’ requests to the same model, made shortly beforehand |
| Other models affected | None, per Cloudflare |
| Root cause | Configuration mismatch in GLM 5.3 triggered an SGLang bug that exposed KV-cache pages across requests |
| Model restored | September 9, 2026 |
| Upstream patch | SGLang v0.5.20, with follow-up fixes in v0.5.21 and v0.5.22 |
Two details stand out. First, the trigger was a prompt-size threshold, not a user action or a network event. Second, the fix landed in an open inference engine that many other operators run, so the repair did not stay inside Cloudflare’s walls.
How a KV Cache Mix-Up Leaks Data Between Customers
A transformer model keeps a running record of the tokens it has already processed so it does not recompute them for every new word it generates. That record is the key-value cache, or KV cache. It lives in GPU memory and grows with prompt length. Serving engines carve that memory into pages and hand pages to requests as they arrive.
The arrangement works because each page belongs to exactly one request at a time. If the engine hands the same page to two requests, or lets a new request read a page that still holds someone else’s tokens, the model can condition its answer on the wrong customer’s text. Nothing needs to be hacked. The model simply reads what sits in the page it was given.
Cloudflare’s account says a configuration mismatch in GLM 5.3 triggered a bug in SGLang, the inference engine, and that bug exposed KV-cache pages across requests. The company has not framed this as an attack, and the available coverage does not describe an attacker. It describes a serving-layer fault that surfaced only under one specific condition.
That distinction shapes the risk. An attacker-driven leak scales with attacker effort. A serving-layer fault scales with traffic and with how often real customers hit the trigger. For a model sold on huge context windows, long prompts are a feature, not an edge case, so the trigger sat inside normal use.
Why Prompts Over 681,280 Tokens Triggered the Bug
Every affected response involved a prompt longer than 681,280 tokens. That is a very specific line, and it tells engineers where to look. The leak did not appear across the model’s general traffic. It appeared only past a size boundary, which points at limits and capacity rather than at a random race between small requests.
Our reading, and it is an inference rather than a Cloudflare statement, is that the failure sits where configured limits meet what the engine can actually hold. Cloudflare’s own description of a configuration mismatch fits that picture. When a deployment promises more than the serving stack can deliver, the oversized requests land in code paths that rarely run in testing.
Long-context models make this class of bug more likely, not less. Each new model that stretches the window, such as Kimi K3.1 Pro with its 1M context window, pushes more traffic toward the extreme end of the size range. Test suites tend to cover typical prompts. Production covers everything.
The 155 count also says something. Cloudflare’s disclosure does not say how many requests cleared the size threshold, so the share of qualifying prompts that produced a mixed response is unknown. What the count does show is a narrow door. A low number reflects that narrow trigger. It does not prove the bug was minor.
The SGLang Fix: v0.5.20, v0.5.21 and v0.5.22
SGLang is the inference engine at the center of the incident. The upstream patch shipped in SGLang v0.5.20, and maintainers followed it with fixes in v0.5.21 and v0.5.22. Three releases in a short span suggests the first patch needed refinement, which is common when a fix touches memory management in a hot path.
Automater’s coverage frames the lesson for anyone running disaggregated inference: update the engine and verify your own configuration. Both halves matter. A patched engine with a mismatched model configuration may still sit near the same cliff.
| SGLang release | Role in the incident | What operators should do |
|---|---|---|
| v0.5.20 | First upstream patch for the cross-request exposure | Treat as the minimum, not the target |
| v0.5.21 | Follow-up fixes | Skip as a stopping point |
| v0.5.22 | Further follow-up fixes | Move to this release or a newer one |
Operators who run SGLang themselves can check what they have in a few seconds:
pip show sglang | grep -i version
pip install --upgrade sglangUpgrading is only the first step. Teams should also confirm that the context length configured for each model matches the capacity of the hardware pool serving it, and they should replay oversized prompts against a staging deployment before and after the upgrade.
What Remains Unconfirmed
Several questions have no public answer yet, and readers should treat any claim that fills them as speculation. The available reporting does not identify which customers were affected. It does not describe what the exposed content contained. It gives no financial impact figure and no count of affected customers, as opposed to affected responses.
Most important, nothing in the sources reviewed says whether anyone accessed or misused the exposed data. A response that contained another customer’s text is a confirmed exposure. Whether a person or system acted on it is a separate question, and the record is silent on it.
The sources also carry no on-record quotation from a named Cloudflare employee that we could verify. That is why this article paraphrases the company’s disclosure and does not put words in anyone’s mouth. We will update the piece if Cloudflare or an affected customer adds detail.
Why the Cloudflare GLM-5.3 Data Leak Matters for Multi-Tenant AI
Multi-tenant inference is the economic engine of hosted AI. Providers pack many customers onto shared GPUs because idle accelerators lose money. Isolation between those customers is a software promise enforced by the serving engine, not a physical wall. The Cloudflare GLM-5.3 data leak shows how thin that software layer can be when a configuration slips.
Prompts increasingly carry sensitive material. Teams paste contracts, source code, support transcripts and internal memos into long-context models precisely because the window is big enough to hold them. A leak that only fires on prompts past 681,280 tokens therefore targets the heaviest and often most sensitive workloads.
The same worry is driving policy. When Sweden’s government blocked ChatGPT, Claude and Copilot on Oct. 26, it signaled that some public bodies would rather lose AI tools than accept uncertainty about where their data goes. An incident like this one gives that caution fresh evidence, even though it involved neither of those products.
Historical Context: Cross-User Leaks in AI Services
This is not the first time a shared AI service showed one user another user’s data. In March 2023, OpenAI disclosed that a bug in an open-source library caused some ChatGPT users to see titles from other users’ conversations. That incident involved a caching layer in the web application, not a model’s KV cache, but the pattern rhymes: a shared component, a rare condition, and a visible cross-user effect.
The 2026 version moves one level down the stack. Earlier leaks lived in application plumbing such as session caches and database clients. This one lived in the inference engine itself, where memory pages hold the model’s working context. Security teams have decades of habits for web caches. They have far fewer for GPU memory.
The industry has also learned that disclosure style matters. Cloudflare published a detailed account that names the model, the window, the response count and the engine versions. That level of specificity lets customers decide whether they were exposed, and it lets other operators check their own stacks. Vague notices do neither.
How Managed and Self-Hosted Inference Compare on Isolation
The incident invites an obvious question: does the delivery model change the risk? The table below is our editorial assessment, not a vendor ranking. It lays out who owns patching, who owns configuration, and where an SGLang-style fault would land under each approach.
| Approach | Who patches the engine | Who owns model configuration | Where this kind of bug lands |
|---|---|---|---|
| Serverless platform (Workers AI) | Platform operator | Platform operator | Customer learns after the fact, as with this incident |
| Hyperscaler managed model service | Cloud provider | Cloud provider | Same pattern, with provider-specific disclosure rules |
| Dedicated or reserved capacity | Provider or customer, by contract | Shared by contract | Narrower blast radius if tenants do not share GPUs |
| Self-hosted SGLang | Your team | Your team | Your own staging and upgrade discipline decide the outcome |
The reports reviewed for this story describe no comparable incident on other platforms, and we draw no conclusion about their safety. Buyers weighing platforms on cost can read our breakdowns of Amazon Bedrock’s Flex, Priority and Batch tiers and Microsoft Foundry pricing, then add isolation questions to the same spreadsheet.
Self-hosting buys control but not immunity. Teams running SGLang on their own GPUs face the same engine bug without Cloudflare’s incident team watching. The upside is that a single-tenant deployment cannot leak one customer’s data to another, because it has only one customer.
Market Impact for Cloud AI Platforms
No financial impact has been reported, and the sources give no figure for customer churn or remediation cost. Any estimate would be invention. What we can describe is the reputational and procurement pressure that a disclosure like this creates for hosted-inference vendors.
Buyers will ask sharper questions. Security questionnaires for AI services already cover data retention and training use. After this incident, expect them to add tenant isolation in the serving engine, test coverage for oversized prompts, and the vendor’s process for patching open-source inference dependencies.
Model suppliers feel the effect too. GLM 5.3 came from Z.ai, but the fault sat in how the model was configured and served, not in the model’s weights. Platforms that host third-party models will need to show that onboarding includes capacity and isolation checks, not just benchmark and latency tests.
The safety conversation widens as well. Frontier labs have spent months arguing over how much testing a model needs before release, a debate sharpened by Anthropic’s decision to hold back Mythos after finding 10,000+ flaws. The GLM 5.3 incident adds a reminder that safe weights can still ride on an unsafe serving stack.
What Engineering Teams Should Do Now
If you called GLM 5.3 on Workers AI
Check your request logs for August 27 through September 9, 2026. Flag any call that sent a prompt longer than 681,280 tokens, since those are the only ones tied to affected responses. Then review what those prompts contained and what you did with the answers. If Cloudflare has not contacted you and you sent such prompts, ask your account team directly.
If you run SGLang yourself
Move to v0.5.22 or later, confirm that every model’s configured context length matches the memory your hardware pool can serve, and add oversized-prompt tests to your release pipeline. Also log request admission decisions so you can see when the engine rejects or trims a long prompt.
If you buy AI for a regulated team
Ask each vendor three things in writing: how it isolates tenants inside the inference engine, how fast it ships patches for open-source serving dependencies, and how it notifies customers when responses were exposed. Vendors that answer in specifics deserve more trust than vendors that answer with certifications alone. Our AI and machine learning coverage tracks how these questions evolve.
Five Predictions After the GLM-5.3 Incident
These are our forecasts, not reported facts. We label them clearly so readers can weigh them against their own view.
- Capacity-versus-context checks become standard. Inference platforms will add automated tests that compare each model’s configured context length against real cache capacity before a model goes live.
- Isolation questions enter AI procurement. By early 2027, security questionnaires for hosted inference will routinely ask how tenants are separated inside the serving engine.
- Open serving engines tighten their test suites. SGLang and its peers will add regression tests for oversized and partially admitted requests, because three patch releases in a short span invite scrutiny.
- More disclosures follow. Other operators will audit their own stacks. At least one more provider will publish a cache-isolation finding within twelve months.
- Sensitive workloads shift toward dedicated capacity. Teams with regulated data will favor reserved or single-tenant deployments for the longest prompts, accepting higher cost for a narrower blast radius.
The Takeaway for Readers
The takeaway: this was a contained fault with an unusually clean disclosure. One model, one trigger condition, 155 responses, a two-week window, a model restored on September 9, and a patch trail across three SGLang releases. Cloudflare did not hide the details, and that helps every operator who now checks their own systems.
Still, the open questions are the ones customers care about most. Who was affected, what the exposed text held, and whether anyone used it are all unanswered in public. Until those gaps close, teams that sent very long prompts to GLM 5.3 during the window should assume exposure is possible and act on it.
The broader lesson reaches past Cloudflare. As context windows grow, the cost of a mismatch between promised and real capacity grows with them. AI platforms that treat isolation as a tested property, and not as a default, will hold customer trust better than those that learn the lesson in production. For another angle on how customers read incidents like this, see the AI Chat Daily report and the engineering analysis on AntonioCortes.com.
Frequently Asked Questions
What happened in the Cloudflare GLM-5.3 data leak?
A configuration mismatch in the GLM 5.3 model on Workers AI triggered a bug in the SGLang inference engine. The bug exposed KV-cache pages across requests, so 155 responses contained data from other customers’ earlier requests to the same model.
When did the exposure happen?
The affected period ran from August 27 to September 9, 2026. Cloudflare restored the model on September 9, 2026.
Were other Workers AI models affected?
No. Cloudflare confirmed that no other model hosted on Workers AI was affected. The problem was limited to GLM 5.3.
Which requests were at risk?
Every affected response involved a prompt longer than 681,280 tokens. Shorter prompts are not tied to the confirmed exposure.
Has anyone confirmed that exposed data was misused?
No. The available reporting does not say whether anyone accessed or misused the exposed content. It also does not identify the affected customers, describe the exact contents, or give a count of customers.
Which SGLang version fixes the problem?
The patch first shipped in SGLang v0.5.20, with follow-up fixes in v0.5.21 and v0.5.22. Operators who self-host should move to v0.5.22 or later and recheck their model configurations.
Should companies stop using hosted AI models?
The facts do not support that conclusion. This was a contained fault in one model and one engine configuration, disclosed in detail. A better response is to add isolation and patching questions to vendor reviews, and to consider dedicated capacity for the most sensitive long-prompt workloads.
