Cloudflare Bug Exposed Customer Data Across Workers AI Requests

Oct 27, 2026
Cloudflare said 155 Workers AI responses from the GLM-5.3 model contained other customers' data, caused by a misconfiguration and an SGLang bug.

Cloudflare said a bug let some customers of its Workers AI service receive data from other customers' requests, disclosing the issue on its blog. Between Aug. 27 and Sept. 9, 155 responses from the GLM-5.3 model contained text from other users' recent requests, all for prompts longer than 681,280 tokens. Cloudflare said no other Workers AI model was affected and it found no evidence of deliberate exploitation.

Security researcher Gadi Evron of Knostic reported the problem through Cloudflare's HackerOne program on Sept. 8. Cloudflare took the model offline within 40 minutes of declaring an incident the next morning and restored it the same day with a fix.

The exposure came from two overlapping issues: Cloudflare had configured the model with a context window larger than the KV cache on its prefill GPUs could hold, and the open-source SGLang inference engine mishandled those over-length requests. Cloudflare published the report together with the SGLang project as a coordinated disclosure.

We hope you enjoyed this article

Consider subscribing to one of our newsletters like Cybersecurity AI Weekly or Daily AI Brief.

Also, consider following us on social media:

Cybersecurity AI AI Brief AI Brief (X)
Free newsletter

Cybersecurity AI Weekly

Weekly newsletter about AI in Cybersecurity.

Guide
Private AI chip companies, by latest reported valuation

Private AI chip companies, by latest reported valuation

Private companies building AI compute silicon (the chips that run AI workloads), shown with each company's most recent reported or disclosed valuation. The figures are measured on different dates and bases, so this is a snapshot, not a live ranking or a like-for-like comparison.

AI Token Webinar

Market report

2025 Generative AI in Professional Services Report

Thomson Reuters

This report by Thomson Reuters explores the integration and impact of generative AI technologies, such as ChatGPT and Microsoft Copilot, within the professional services sector. It highlights the growing adoption of GenAI tools across industries like legal, tax, accounting, and government, and discusses the challenges and opportunities these technologies present. The report also examines professionals' perceptions of GenAI and the need for strategic integration to maximize its value.

Read more

You may also like

Free, six days a week

Daily AI Brief: the AI news that matters, in your inbox.