Cloudflare has disclosed a Workers AI data leak that briefly showed some customers pieces of other customers’ prompts. The problem affected one model, GLM-5.3, and only very long prompts. The company says 155 responses were affected, it found no sign of deliberate exploitation, and the model was fixed and restored on September 9.
What Happened in the Workers AI Data Leak
On September 8, a security researcher named Gadi Evron of Knostic reported through Cloudflare’s HackerOne program that very long prompts sometimes returned text from other people’s sessions. Cloudflare reproduced the problem the next morning and pulled the model offline within 40 minutes of declaring an incident. The exposure had been live since August 27, when the model launched on the platform.
Cloudflare says the affected requests all used prompts longer than 681,280 tokens. After removing its own tests and the researcher’s, the remaining requests looked like ordinary long-context use. The company says no other model hosted on Workers AI was touched.
| Detail | What Cloudflare Reports |
|---|---|
| Affected model | GLM-5.3 on Workers AI |
| Exposure window | August 27 to September 9, 2026 |
| Affected responses | 155, all to prompts over 681,280 tokens |
| Evidence of deliberate abuse | None found |
| Fix | Configuration change plus an engine patch, then restored September 9 |
How the Cloudflare KV Cache Bug Worked
When an AI model reads your prompt, it stores intermediate results in a working memory called the KV cache. That memory sits on the GPU as a pool of pages that get reused from one request to the next, and the software is responsible for tracking who owns each page.
Two things lined up badly here. Cloudflare set GLM-5.3 to accept prompts up to 1,048,576 tokens, but the memory pool on its prefill GPUs only had room for 681,280. The open-source engine it uses, SGLang, was supposed to reject anything too long, yet a bug let those rejected requests slip through the handoff between the two groups of GPUs.
The result was a reply that read from memory pages the new request never filled in. Those pages still held leftovers from earlier users. Instead of an error, the customer got a normal-looking response.
Why Nobody Noticed Before Launch
Cloudflare says it knew about the size mismatch before launch. Its long-context tests returned successful status codes, so the team assumed the engine would handle the gap gracefully. The company admits it checked response codes and speed, but not whether the model output actually made sense.
How Cloudflare Fixed the Workers AI Leak
The company took several steps before bringing the model back:
- It enlarged the memory pool to about 2.04 million tokens, roughly double the model’s context length, so a valid prompt always fits.
- It patched the engine so a rejected request is stopped with its original error before any data moves between GPUs.
- It applied the same hardening to every model it serves with SGLang.
- It added a deployment check that compares pool size against context length on the running engine.
Cloudflare also worked with the SGLang maintainers, and the fixes are in SGLang version 0.5.22. It urges anyone running the engine in a split prefill and decode setup to update. It is also exploring page-level tags that would make the engine fail a request rather than return another user’s data.
What This Means for You
If you build on hosted models, this is a reminder that AI infrastructure can fail in the same ways as any shared system. Cloudflare says only a small number of customers saw leaked content, and only with extremely long prompts. Still, a few habits help whichever provider you use.
- Keep secrets, passwords and customer records out of prompts unless the task truly needs them.
- Be careful with very long prompts on newly launched models, since edge cases show up first at the limits.
- If you self-host with SGLang, update to version 0.5.22 or later and check that your memory pool is larger than your context window.
- Test model output for coherence, not just HTTP success codes.
The episode also fits a wider pattern of security questions around AI tools. For related reading, see how teams are using AI threat detection, the funding behind agent security startups, and the push for workplace AI security. You can also browse our latest AI news and an earlier look at GLM-5.3 research.
Sources
Primary source: Cloudflare’s incident report on the GLM-5.3 Workers AI issue. All figures and dates come from that report.
Conclusion
The Workers AI data leak was narrow, caught through a responsible report, and fixed within a day of discovery, but it shows how a small mismatch between settings and software can expose private data. Cloudflare’s decision to publish the full timeline and push fixes upstream gives other operators a clear checklist to follow.
