Cloudflare: 155 GLM-5.3 Responses on Workers AI Carried Other Customers' Data Between Aug. 27 and Sept. 9

Cloudflare said Monday that 155 responses from its GLM-5.3 model on Workers AI contained data from other customers' requests, between August 27 and September 9, 2026. Every affected prompt was longer than 681,280 tokens, and Cloudflare said no other Workers AI model was affected.

The company published the account in a post on its blog on October 26, as a coordinated disclosure with SGLang, the open-source serving engine it runs the model on. The post says affected customers "received responses that contained data from other customers' requests made to the same model shortly before theirs."

Cloudflare said it found "no evidence of deliberate exploitation." After excluding its own testing and the researcher's, it said the matching requests looked like ordinary long-context use in timing and volume.

Two faults that had to overlap

The first was a configuration. GLM-5.3, a Z.ai model built for agentic coding, was deployed with a 1,048,576-token context window. The prefill KV cache pool, the memory that holds a prompt's attention state, held only 681,280 tokens. Cloudflare said it knew of the mismatch before launch.

Pre-launch tests returned successful HTTP codes and streams with no error frames. The post says the team "expected the engine to return an error for any prompt it could not process" and that it "only validated HTTP response codes and engine performance at long contexts."

The second was a bug in SGLang's disaggregated mode, where prefill and decode run on separate nodes. The engine marked an over-length request as rejected and swapped its prompt for a one-token placeholder. It did not abort. Prefill sent the placeholder's KV to decode, which assumed the full prompt had overwritten old pages. Stale pages from earlier requests remained, and decode attended over them.

The admission queues checked finished() rather than whether a request had been rejected. Clients therefore received HTTP 200 instead of HTTP 400. The bug had been filed upstream as SGLang issue #30233 on July 6, 2026, seven weeks before the model launched.

The September 8 and 9 timeline

Gadi Evron of Knostic reported the flaw through HackerOne at 23:11 UTC on September 8, per the post. Cloudflare began verifying at 08:00 UTC the next day.

Time (UTC), Sept. 9	Event
13:22	Incident declared; leak reproduced with two accounts in 25 minutes
14:00	GLM-5.3 set to private; requests return HTTP 400
14:52	All prefill nodes rolled to corrected configuration
19:40	Model restored to public

The model was unavailable for about 5 hours 40 minutes by those timestamps. Cloudflare said a canary prefill node with a larger pool was not susceptible, which is how it identified the root cause at 14:35.

What Cloudflare changed

The fix aligned GLM-5.3 with the GLM-5.2 configuration, which expands the pool to about 2.04 million tokens, roughly twice the context length. Valid prompts no longer reach the rejection path. Cloudflare also patched SGLang so rejected requests are retired at the admission queue with their original error, and proposed that change as pull request #38704.

SGLang v0.5.21 shipped October 2. Release v0.5.22 followed on October 19, and Cloudflare tells operators to run it or later. Its notes list abort-acknowledgement and prefill-decode transfer fixes among more than 20 disaggregation changes, though the page does not tie any single item to this incident.

Cloudflare said it now checks KV pool size against context length on the running engine before changes ship, and tests model output rather than status codes. A page-tag integrity check, prototyped on GLM-5.2 in mid-August, was disabled for reliability problems and has not shipped. The company said it plans to formally model its RDMA-based KV transfer protocol.

Why this matters for other hosts

Cloudflare's checklist for operators is five items long. It starts with measuring KV pool size against context length on every prefill and decode node after any change, and ends with avoiding load balancer aborts before the first token.

The site has covered other ways model-serving state goes wrong, including a demo that rewrites a model's weights in GPU memory and hidden instructions in WhatsApp's chatbot. Those are separate cases from this one.

Cloudflare did not say how many customers received another customer's data, only that 155 responses were affected.