Cloudflare says a bug affecting its GLM-5.3 model on Workers AI exposed data from some customers’ requests to others between August 27 and September 9, 2026. The company identified 155 affected responses, all generated from prompts longer than 681,280 tokens, and found no evidence that the issue was deliberately exploited.
The problem came to light after security researcher Gadi Evron of Knostic reported it through Cloudflare’s HackerOne program on September 8. Cloudflare reproduced the issue the following morning, took the model offline within 40 minutes of declaring an incident, and restored it later that day after deploying configuration and engine fixes. The company said no other model hosted on Workers AI was affected.
Cloudflare attributed the exposure to two problems. GLM-5.3 was configured with a context window of 1,048,576 tokens, but the KV cache pool on its prefill GPUs could hold only 681,280 tokens. Separately, SGLang, the inference engine used to serve the model, mishandled requests that exceeded the pool’s capacity in its disaggregated prefill-and-decode setup.
Instead of stopping an oversized request and returning an error, the affected SGLang path replaced its prompt with a one-token placeholder. The prefill stage then transferred cache data for that placeholder, while the decode stage treated the transfer as complete and read the full set of pages reserved for the original request. Most of those pages had not been overwritten and still contained data from earlier requests, which could then appear in the response.
Cloudflare changed the configuration so the prefill KV pool can hold about 2.04 million tokens, roughly twice the model’s context length. It also patched SGLang to retire rejected requests before bootstrap, memory allocation or KV transfer, and added a check that the number of transferred tokens matches the amount reserved by decode. The company says it tested the changes against the researcher’s reproduction script and its own canary-marker tests before restoring the model.
The incident also prompted broader safeguards across Cloudflare’s SGLang deployments, including checks that pool capacity exceeds the context length and measures to reduce risks from KV cache transfers and page reuse. Cloudflare recommends that operators using disaggregated SGLang update to version 0.5.22 or later, or backport the relevant fixes. The company said fixes addressing the incident and related cache issues have been merged upstream, with most included in SGLang 0.5.22.
Sources: Cloudflare Blog.