Cloudflare says a Workers AI bug sent other users' prompts in 155 responses

Cloudflare published a postmortem on October 26, 2026 about a data leak in Workers AI, its serverless AI model API. From GLM 5.3’s launch on August 27 until a fix on September 9, very long prompts to the model sometimes got back content from other customers’ requests. Cloudflare says “155 responses were affected, all to prompts longer than 681,280 tokens,” and that a small number of customers received them.

What happened

GLM 5.3 (@cf/zai-org/glm-5.3) was set up with a 1,048,576-token context window, but the memory pool that holds the model’s working cache for incoming prompts had room for only 681,280 tokens. Cloudflare says it knew about the mismatch before launch but expected over-length prompts to fail with an error. Its pre-launch tests checked status codes, not the quality of the output.

A bug in SGLang, the open-source serving engine, meant those over-length requests were not stopped. They returned a normal success response, generated from stale cache pages left by earlier requests. Cloudflare says those pages held “other users’ prompts and partial generations.” It does not say how much of any one customer’s data was exposed, or how many customers were affected.

Timeline

Date (UTC)	Event
Aug 27	GLM 5.3 launches; exposure begins
Sep 8, 23:11	A researcher reports the leak through HackerOne
Sep 9, 14:00	Cloudflare makes the model private; requests return errors
Sep 9, 19:40	The model is restored with a fixed setup and a patched engine
Oct 26	Coordinated public disclosure

Cloudflare says it found “no evidence of deliberate exploitation.” The cache pool now holds about 2.04 million tokens, roughly twice the context length, and Cloudflare added checks across its SGLang deployments. Fixes were also merged into SGLang itself.

Who it affects

Only replies to prompts over 681,280 tokens carried other users’ data, but Cloudflare does not say whose prompts were in the leaked cache pages. So if you used GLM 5.3 on Workers AI between August 27 and September 9, the post does not let you tell whether your data was exposed. It also does not say whether affected customers were notified, and it gives no steps for Workers AI customers.

If you run SGLang yourself in disaggregated mode, Cloudflare recommends checking the cache pool size against the context length and upgrading to SGLang 0.5.22 or later. To compare hosted model APIs and their prices, see our AI models page.