For about two weeks, some people using an AI model on Cloudflare’s Workers AI service got answers that contained other customers’ data. Cloudflare says it happened in 155 responses between 27 August and 9 September 2026, all to very long prompts, and that it was fixed on 9 September. The company published the full account on 26 October. This is an older incident that is over, not a leak happening now. Everything below is Cloudflare’s own account in its post, which I read on 27 October; I could not verify it independently.
The short answer
- What leaked: 155 responses from the GLM-5.3 model held data from other customers’ requests.
- Who was affected: only prompts longer than 681,280 tokens, on GLM-5.3. Cloudflare says no other Workers AI model was affected.
- When: 27 August to 9 September 2026. The model was restored on 9 September.
- Was it exploited: Cloudflare says it found no evidence of deliberate exploitation.
What went wrong, in plain terms
Two mistakes combined.
- A settings mismatch. GLM-5.3 was deployed to accept prompts up to 1,048,576 tokens, but the memory it uses to hold a prompt (the “KV cache”) only had room for 681,280.
- A software bug. In the serving software, SGLang, a prompt that was too long was marked as rejected but not stopped. The system then read leftover memory from earlier requests, so the answer contained someone else’s data, and it still reported success (HTTP 200) instead of an error.
That second point is the lesson. The answer looked like a normal success, so a status code alone could not have caught it.
Timeline (UTC)
| Date | Event |
|---|---|
| 27 Aug | GLM-5.3 launched with the undersized memory |
| 8 Sep, 23:11 | Gadi Evron of Knostic reported it through Cloudflare’s HackerOne programme |
| 9 Sep, 13:22 | Incident declared; reproduced with two independent accounts within 25 minutes |
| 9 Sep, 14:00 | Model made private |
| 9 Sep, 19:40 | Corrected version restored to the public |
| 26 Oct | Cloudflare published its account |
The fix, and advice for people who run AI services
Cloudflare made the memory about twice the context length (about 2.04 million tokens) and changed the software so rejected prompts end with their original error before any memory is shared. For anyone running SGLang it recommends upgrading to v0.5.22 or later, checking that memory size matches the context length on every node, and turning on corruption detection where the model supports it. The post gives no steps for Workers AI customers beyond reporting security issues through HackerOne.
A practical checklist for your own service, based on what went wrong: confirm that your cache limits match the context length you advertise; test isolation between customers by sending recognisable marker text and checking it never appears in another account’s answer; and do not rely on a success code as proof the output is right.
What it does not show
- It does not say GLM-5.3 on other platforms was affected.
- Cloudflare found that affected requests matched ordinary long-prompt use, so its finding is that deliberate exploitation was not evident, not that no data was exposed.
Terms in plain language
- Workers AI: Cloudflare’s service for running AI models
- GLM-5.3: an AI model the service offered
- Token: a small piece of text a model reads or writes; the prompt length is counted in tokens
- Context window: the maximum amount of text a model can take in at once
- KV cache: the working memory a model keeps for the prompt it is handling
- Prefill and decode: the two stages of answering: reading the prompt, then writing the reply
- SGLang: open-source software used to serve AI models
- HTTP 200 / 400: the “success” and “bad request” status codes a web service returns
- HackerOne: a platform where researchers report security problems to companies
Questions and answers
Is the leak still happening?
No. Cloudflare says the model was restored on 9 September after the fix.
Were all Workers AI models affected?
No. Cloudflare says only GLM-5.3 was.
Was my data exposed?
Cloudflare’s post gives no customer instructions beyond reporting security issues through HackerOne. Contact Cloudflare if you used GLM-5.3 with very long prompts in that window.
Sources
Facts read on 27 October 2026.
