Cloudflare has disclosed that a bug in its AI hosting service sent other customers’ data to 155 prompts over two weeks — and every affected reply arrived looking like a success. The company published its account on October 26, 2026, after fixing the problem on September 9. The incident is over, but the post-mortem is a warning for anyone running large AI models: the failure was invisible to every check that only looks at status codes.
The affected service was GLM-5.3, a text generation model from Z.ai built for agentic coding work, offered through Cloudflare’s Workers AI platform under the name @cf/zai-org/glm-5.3. Between August 27, when the model launched on Workers AI, and September 9, a small number of customers received responses containing data from other customers’ requests made to the same model shortly before theirs. In total, 155 responses were affected, Cloudflare said, and every one of them went to a prompt longer than 681,280 tokens.
To understand what went wrong, it helps to know what a KV cache is. When a language model reads a prompt, it stores working notes in GPU memory. Those notes live in a shared pool of fixed-size pages, and pages are not wiped between customers — the next request simply overwrites them. That works only if the system tracks exactly which pages belong to which request.
Cloudflare’s deployment broke that tracking in two overlapping ways. First, a configuration mismatch: GLM-5.3 was advertised with a context window of 1,048,576 tokens, but the memory pool on its prefill GPUs — the machines that first read the prompt — held only 681,280 tokens. Cloudflare says it knew about the gap before launch and expected the inference engine to return an error for any prompt it could not fit. Second, a bug in SGLang, the open-source inference engine Cloudflare uses: when a prompt did not fit the pool, the engine marked it as rejected and quietly swapped it for a one-token placeholder, but instead of aborting the request, it sent a “transfer complete” signal to the decode machines that write the answer. Those machines assumed the full prompt had overwritten the old pages. It had not. Most of the pages still held earlier requests, so the model answered using other users’ prompts and partial generations.
The result was a failure dressed as success. The customer received HTTP 200 — the web’s standard success code — instead of HTTP 400, an error. The token count matched the long prompt, and the reply read coherently. It even arrived faster than a full-length prompt should have taken. Cloudflare is blunt about why its own testing missed this: “we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.” Nothing in the response said anything was wrong, because the system never checked what the response actually contained.
Security researcher Gadi Evron of Knostic flagged the issue through Cloudflare’s HackerOne program on September 8. Cloudflare reproduced it the next morning, declared a security incident at 13:22 UTC on September 9, and set the model to private within 40 minutes, so new requests failed with an error. The prefill machines were rolled to a corrected configuration the same afternoon, and the model returned to public service at 19:40 UTC that day.
Two limits on the scope matter. Cloudflare says no other model hosted on Workers AI was affected, because every other deployment had memory pools larger than its context window. After excluding its own testing and the researcher’s requests, Cloudflare found the affected requests consistent with ordinary long-context use, not repeated exploitation. The company says it found no evidence of deliberate exploitation — a careful claim, not a guarantee that no one ever saw another customer’s data.
The fix has two parts. Cloudflare enlarged the prefill memory pool to about 2.04 million tokens, roughly twice the model’s context length, so a prompt that fits the advertised window always fits the pool. It also patched the engine so a request carrying a pending rejection is retired with its original error before any memory transfer happens. Upstream, the SGLang fixes shipped across versions 0.5.20 and 0.5.21, with the complete fix in version 0.5.22, released October 19. Cloudflare recommends that all operators using SGLang update to version 0.5.22 or later — and, more broadly, that they check memory pool size against context length directly from the running engine, rather than inferring it from response codes.
A critical flaw disclosed this month took government websites offline, and AI agents were used to breach thousands of companies through a remote-access tool — in both cases, trusted machinery behaved in ways its operators had not verified. The Cloudflare incident is quieter, but its lesson is sharper: when an AI system answers, a success code is not evidence that the answer is yours. Patching is only the first step; someone has to read what the machine actually said.
Source: Cloudflare blog, “Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang,” October 26, 2026.
