Cloudflare Workers AI Bug Exposed Other Customers' Prompts in 155 Responses: What AI Buyers Should Check

The incident is a useful warning for any team buying hosted AI inference. The affected requests were very long prompts, and users still received normal HTTP 200 responses, so nothing looked broken on the client side. Cloudflare published its explanation in a post titled Cross-request KV cache exposure in the GLM-5.3 Workers AI model, with trade coverage following on October 27 and 28.

What happened

A model with a roughly 1.05 million token context window was served on GPUs whose cache pool held only 681,280 tokens. Prompts above that size triggered a faulty SGLang path, and generation read stale cache pages from earlier requests.

According to reporting by TokenPost and GIGAZINE, SGLang replaced oversized inputs with a one-token placeholder instead of aborting the request. The placeholder was cached and passed on, and generation nodes sometimes returned data left in memory by other requests.

• Window: requests processed from August 27 to September 9, 2026.
• Scope: 155 responses, all to prompts longer than 681,280 tokens, and only the GLM-5.3 model on Workers AI.
• Report and fix: a researcher reported the problem on September 8 and Cloudflare restored a patched model on September 9.
• Exploitation: Cloudflare found no evidence of deliberate exploitation after excluding its own tests and the reporter's requests.

Why it matters for B2B teams

The incident shows that multi-tenant AI inference can leak data through caching, not only through access control failures. A prompt may contain contracts, source code or customer records, so a leak across tenants can become a reportable data event.

Cloudflare said its pre-launch tests checked status codes and performance for long prompts but did not verify the content of generated outputs. That gap is common: many AI vendor evaluations measure latency and accuracy but skip adversarial tenant-isolation checks. Teams should also note that the issue was disclosed weeks after the fix, so your own monitoring cannot rely on vendor timing alone.

What to do now

Check whether your organization used GLM-5.3 on Cloudflare Workers AI between August 27 and September 9, review vendor notices, and add isolation checks to your AI procurement process. Treat the response as a vendor-risk review, not only a patch task.

• Confirm exposure: search logs and billing for GLM-5.3 usage in the window, especially prompts over 681,280 tokens.
• Ask vendors for evidence: request root-cause reports, affected-customer notification policy and content-level test results.
• Self-hosted SGLang: Cloudflare advises comparing each node's cache capacity with its configured context length and upgrading to SGLang v0.5.22 or later.
• Reduce prompt sensitivity: redact secrets and personal data before sending long contexts to shared inference.
• Add canary tests: send unique marker strings across tenants in staging and verify they never appear elsewhere.
• Update contracts: require breach notification timelines and isolation guarantees for AI services.

Frameworks help structure this work. The NIST AI Risk Management Framework covers governing and measuring AI system risk, and the OWASP Top 10 for LLM Applications lists sensitive information disclosure among key risks.

Related SaaSPodium resources

Teams that run AI services in production need monitoring that surfaces anomalies early, because a leak like this produces no errors and only careful output checks reveal it. The next paragraph lists categories and tools to compare.

Compare options in our Application Performance Management and Log Management categories, or review tools such as Datadog APM and Elastic APM for tracing requests end to end.

For related coverage, read our reports on the LiteLLM supply chain compromise and Microsoft's AI agent security controls.

Frequently Asked Questions

Was my company's data exposed in the Cloudflare GLM-5.3 incident?
Only 155 responses to prompts longer than 681,280 tokens are reported as affected, from August 27 to September 9, 2026. Check your usage logs for GLM-5.3 in that window and contact Cloudflare support if you used long prompts.

Should we stop using hosted AI inference after this incident?
Not necessarily, but add controls. Require vendors to document tenant isolation, test outputs for cross-request leakage, minimize sensitive data in prompts and keep breach notification terms in contracts.

How can we test an AI provider for cross-tenant leakage?
Use canary strings: send unique markers from one test tenant, then run long-context and edge-case prompts from another tenant and confirm the markers never appear. Repeat after model or serving-engine changes.