Cloudflare disclosed a cross-customer data exposure in Workers AI’s GLM-5.3 service, traced to an SGLang cache-handling bug and since remediated.
Cloudflare disclosed on October 26 that a tenant-isolation flaw in its Workers AI deployment of Z.ai’s GLM-5.3 model caused some responses to include material from other customers’ recent requests. The company says the exposure occurred from August 27 to September 9, 2026, and affected 155 responses. It found no evidence that the issue was deliberately exploited and said no other Workers AI model was affected.
The problem appeared only with prompts exceeding 681,280 tokens. Cloudflare’s configuration allowed a 1,048,576-token context window, but the prefill GPUs’ key-value cache pool could hold fewer tokens. When an over-limit request was rejected, a bug in SGLang’s disaggregated serving path did not properly abort the handoff: stale cache data could remain available to the decode stage, which then generated a response containing text from another session. Cloudflare says it reproduced the issue after a researcher’s September 8 report, took the model offline, patched the configuration and inference engine, and restored service on September 9.
The disclosure matters because inference providers isolate many customers on shared hardware, and model-serving infrastructure can create privacy risks even when the model itself is not compromised. The incident also highlights how very long context windows can stress cache-capacity assumptions and error-handling paths. Cloudflare says the report was published in coordination with SGLang maintainers, who describe related request-isolation fixes and hardening work in their own account.
The company reports that it expanded the relevant cache pool and deployed a patched rejection path before restoring public access. It says it continues working with upstream SGLang maintainers on fixes for similar classes of cache-lifetime and cross-request isolation bugs. The disclosure does not establish that customers’ data was accessed by an attacker; Cloudflare’s investigation characterized the observed requests as consistent with ordinary long-context use.