Cloudflare details a Workers AI bug that leaked data between requests

Cloudflare published an incident report, coordinated with the SGLang project, describing a bug in its GLM-5.3 Workers AI model that let some responses contain data from other customers' requests. The issue affected 155 responses between August 27 and September 9, 2026, all triggered by prompts longer than 681,280 tokens, and was reported by security researcher Gadi Evron of Knostic. Cloudflare says it found no evidence of deliberate exploitation, and that no other model on Workers AI was affected.

The root cause was two overlapping problems. Cloudflare had deployed GLM 5.3 with a 1,048,576-token context window, but its KV cache memory pool on prefill GPUs could only hold 681,280 tokens, a mismatch Cloudflare knew about but believed the inference engine, SGLang, handled gracefully. Separately, a bug in SGLang meant that when a prompt exceeded the pool size and was rejected, the system still ran a placeholder request through the pipeline and told the decode node its KV cache transfer was complete, when in fact most of the memory still held older, unrelated request data. The decode node then generated a reply using that leftover data.

Cloudflare fixed its own configuration so the memory pool now holds about twice the model's context length, and patched SGLang so rejected requests are stopped before any memory handoff happens, changes it has proposed upstream. The company says this incident reflects a broader class of memory-safety bugs in KV cache handling that it has been working with the SGLang maintainers to address.

Why it matters

The bug is a concrete reminder that shared GPU memory pools in multi-tenant LLM serving can leak one customer's data into another's response.

Source: Cloudflare