Cloudflare discloses a Workers AI bug that mixed other customers' data into 155 GLM-5.3 responses

On 26 October 2026 Cloudflare published an incident report explaining that the GLM-5.3 model on its Workers AI platform returned data from other customers' requests in 155 responses. The issue ran from 27 August to 9 September 2026, affected only very long prompts, and has been fixed.

What happened

Workers AI is Cloudflare's service for running AI models on its network. GLM-5.3 is a model from Z.ai that Cloudflare hosts there.

According to Cloudflare, prompts longer than 681,280 tokens could produce responses that drew on stale data left in memory from earlier requests. That data could include other users' prompts and partially generated answers. Cloudflare says a small number of customers were affected; it does not give an exact count.

The report was coordinated with an outside researcher. Cloudflare received the report on 8 September and restored the model on 9 September. It also states: "We have confirmed that no other model hosted on Workers AI was affected."

Why it happened

Cloudflare describes two problems that combined:

• A configuration mismatch. The model was offered with a context window (the maximum prompt size) of 1,048,576 tokens, but the memory pool used to hold a request's working data, called the KV cache, only had room for 681,280 tokens.
• A bug in SGLang, the open-source serving software Cloudflare uses. In a setup that splits reading the prompt and writing the answer across different machines, requests that were too long were marked as rejected but still passed along. The machine writing the answer then read leftover memory pages from earlier requests.

In plain terms: a request that should have been refused with an error was instead processed using someone else's leftover data.

The fix

• Cloudflare enlarged the KV cache pool for GLM-5.3 to about 2.04 million tokens, more than the advertised context window.
• It patched its serving engine so rejected requests return an error before any data moves between machines.
• Fixes were contributed upstream to SGLang in versions 0.5.20, 0.5.21 and 0.5.22.
• Cloudflare says it is adding further safeguards, including checksums and changes to when cached memory is released.

Who should care

• Workers AI customers who used GLM-5.3 with very long prompts during the window. Cloudflare's post does not say whether affected customers were notified individually, and it gives no specific action for customers.
• Anyone running SGLang themselves in the split prefill/decode setup. Cloudflare's guidance is aimed at you.
• Every business buying hosted AI. This is a reminder that keeping one customer's data separate from another's depends on the provider's infrastructure, not just on the model.

Limits of what we know

The post describes how many responses were affected, not how much sensitive data those responses contained. Cloudflare reports no other Workers AI models were affected. Questions about notification of specific customers are best put to Cloudflare directly.

What to do this week

1. If you used GLM-5.3 on Workers AI between 27 August and 9 September with prompts near the context limit, review what data you sent and contact Cloudflare support if you need to assess exposure.
2. If you self-host with SGLang, upgrade to version 0.5.22 or later (or backport the patches), and after every configuration change confirm that each node's KV cache pool is at least as large as the context length you advertise.
3. Add tenant isolation to your AI vendor checklist. Ask how providers keep requests apart on shared hardware, and how they would tell you if that failed.
4. Send less sensitive data. Strip personal and confidential details from prompts where the task does not need them.

The DevDrift helps teams design AI workflows with data minimisation, approvals and audit trails built in.

Sources

• Cloudflare: Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang (26 October 2026)