Cloudflare reveals that a Workers AI bug exposed other customers' data in 155 responses

Cloudflare published on its blog on Monday 26 October that some customers of Workers AI, its AI model inference service, received responses containing data from other customers' requests made shortly before to the same model, GLM-5.3. According to the company, there were 155 responses, all to requests of more than 681,280 tokens, between 27 August, the day the model was launched, and 9 September.

Cloudflare explains that two problems combined: the model advertised a context window of 1,048,576 tokens, but the cache memory of its prefill GPUs only had room for 681,280; and a bug in the open-source software SGLang meant that requests that did not fit, instead of being rejected with an error, were processed on cache pages that still contained data from previous requests.

According to Cloudflare's timeline, researcher Gadi Evron (Knostic) reported it on 8 September through its bug bounty programme on HackerOne. The company declared the incident on 9 September at 13:22 UTC, withdrew the model at 14:00 and made it available again at 19:40 with the corrected configuration. The SGLang maintainers subsequently released versions with fixes, and disclosure by both parties was coordinated for 26 October.

Cloudflare says it found no evidence of deliberate exploitation, because the affected requests match normal long-context usage in timing and volume, and that no other Workers AI model was affected. The post does not detail what data the responses contained, how many customers were affected or whether they have been notified.