Quick Answer
Cloudflare says a Workers AI cache bug caused Z.ai’s GLM-5.3 to return data from other customers’ requests in 155 responses. The exposure affected exceptionally long prompts between August 27 and September 9, 2026. Cloudflare fixed the serving configuration and request-handling issue. Organizations that used affected long-context requests should review what they submitted and assess whether exposed prompt content requires follow-up.
Key Takeaways
- Cloudflare recorded 155 responses containing data from another customer’s request.
- The exposure affected GLM-5.3 prompts longer than 681,280 tokens.
- The issue existed from August 27 through September 9, 2026.
- Cloudflare says it found no evidence of deliberate exploitation beyond testing.
- Cloudflare increased the relevant cache pool to about 2.04 million tokens.
What happened in the Cloudflare Workers AI data leak?
Cloudflare says a cache isolation failure in its Workers AI deployment of Z.ai’s GLM-5.3 model returned portions of other customers’ request data in 155 responses. The company disclosed the incident on October 26, 2026, after investigating a report submitted through its HackerOne program by security researcher Gadi Evron of Knostic. Cloudflare’s incident report describes the issue as a cross-tenant exposure, meaning one customer could receive data associated with another customer’s request.
The incident matters because prompts can contain material that users do not expect other customers to see, including source text, instructions, business data, or personal information. Cloudflare says the affected output occurred only under a specific long-context condition, rather than across every GLM-5.3 request. That limitation reduces the scope of the exposure, but it does not remove the need for affected organizations to examine the sensitivity of any unusually long material they sent to the model.
Cloudflare says it found no evidence of deliberate exploitation after excluding activity from its own testing and the researcher’s testing. That finding is not proof that no unintended recipient ever saw sensitive information. The practical interpretation is that customers should base their response on the content they submitted, particularly when prompts included confidential data or material copied from internal systems.
When did the GLM-5.3 prompt exposure occur?
The GLM-5.3 exposure existed from August 27, 2026, until Cloudflare remediated it on September 9, 2026. Cloudflare says the problem began with the model’s launch and affected prompts exceeding 681,280 tokens. A token is a unit of text processed by an AI model, and a token count of that size represents exceptionally large inputs rather than ordinary chatbot conversations.
Gadi Evron reported the tenant-isolation issue on September 8, 2026. Cloudflare says it reproduced the issue and declared an incident at 13:22 UTC on September 9, made GLM-5.3 private at 14:00 UTC, and restored public availability at 19:40 UTC after applying remediation. The timeline indicates that Cloudflare removed public access while it addressed the issue instead of leaving the affected deployment available during investigation.
| Event | Date or time | Why it matters |
|---|---|---|
| GLM-5.3 launch and exposure begins | August 27, 2026 | The affected long-context deployment became available. |
| Researcher report | September 8, 2026 | Cloudflare received a report of the tenant-isolation issue. |
| Incident declared | September 9, 2026, 13:22 UTC | Cloudflare says it reproduced the issue and began formal response work. |
| Model made private | September 9, 2026, 14:00 UTC | Public access was removed while remediation proceeded. |
| Public access restored | September 9, 2026, 19:40 UTC | Cloudflare says the corrected deployment returned to service. |
| Public disclosure | October 26, 2026 | Cloudflare described the root cause, impact, and remediation. |
Organizations that used GLM-5.3 during that period should first determine whether any requests approached the affected threshold. Ordinary short requests do not match Cloudflare’s stated condition. Organizations that relied on very large document sets, logs, repositories, or extended AI context should preserve relevant records before changing retention settings or deleting operational logs.
Why did the Workers AI cache bug expose another customer’s data?
The Workers AI cache bug occurred because GLM-5.3 advertised a 1,048,576-token context window while its prefill KV-cache pool held only 681,280 tokens, according to Cloudflare. A KV cache stores intermediate model processing data so an AI system can handle prompt context more efficiently. Cloudflare says an SGLang request-handling bug combined with that capacity mismatch and allowed data from an earlier request to appear in a later response.
The technical detail matters because the problem was not described as a general failure of every Workers AI model or every Cloudflare service. The conditions involved a particular model deployment, a particular cache arrangement, and requests beyond the smaller cache-pool limit. Customers should therefore avoid assuming that a separate AI tool has the same issue without evidence, even as they review whether their own long-context workflows create similar privacy dependencies.
Long context windows are useful when an AI system must analyze large collections of documents or code in a single request. The same capability can increase the amount of information placed into one processing path. Teams building connected AI workflows should also evaluate the permissions granted to models, especially as services increasingly connect to email, files, calendars, and other data sources. TechJournal has covered how AI search connects to more apps, which makes careful data scoping more important.
Who was affected by the Cloudflare GLM-5.3 incident?
Cloudflare says the affected population was limited to customers whose GLM-5.3 prompts exceeded 681,280 tokens during the August 27 through September 9 exposure period. Cloudflare recorded 155 responses that included data from another customer’s request. The company did not state in the supplied incident details that every long prompt produced exposed data, so customers should not treat the threshold as proof that exposure occurred in every qualifying request.
The most relevant users are organizations that sent unusually large context bundles to GLM-5.3. Those requests could include lengthy internal documents, extensive codebases, large support archives, or machine-generated data. The prompt length is important because it defines the reported technical condition, while the content inside the prompt determines the practical privacy and security impact.
Teams should classify affected requests by sensitivity before deciding on further action. A long prompt containing public material creates a different risk than one containing credentials, customer records, internal source code, or regulated information. The most sensible approach is to involve the organization’s security and privacy staff when the request content included information that would require incident review if disclosed outside the company.
What did Cloudflare change after finding the cache issue?
Cloudflare says it increased the prefill KV-cache pool to about 2.04 million tokens, roughly twice GLM-5.3’s configured 1,048,576-token context length. The larger pool is intended to prevent the capacity mismatch that existed in the affected deployment. Cloudflare also says it addressed the request-handling problem connected to the exposure.
SGLang says it worked with Cloudflare on the rejection-path and cache-lifetime fixes, and that the disclosure was coordinated with Cloudflare and the researcher. The SGLang security disclosure provides the project’s account of the coordinated remediation. This matters because cache isolation requires both adequate resource configuration and correct software behavior when requests are rejected, retried, or released.
Cloudflare also recommends that operators using disaggregated SGLang serving update to version 0.5.22 or later. Operators should follow that version guidance for their own SGLang environments, but they should stop and consult their platform or security team before changing a production AI serving stack. A rushed software update can interrupt model availability or change infrastructure behavior, particularly where custom routing, caching, or observability tools are involved.
What should Cloudflare Workers AI customers do now?
Cloudflare Workers AI customers should review GLM-5.3 usage from August 27 through September 9, 2026, if their workloads sent prompts longer than 681,280 tokens. Start by identifying long-context applications and preserving request metadata, access records, and prompt-handling logs. The goal is to establish whether the organization submitted data that would create material risk if another customer received a portion of it.
- Identify GLM-5.3 applications that ran during the affected period.
- Review whether those applications submitted prompts above the reported 681,280-token threshold.
- Classify the content in qualifying prompts, including confidential, personal, regulated, or credential-related information.
- Document the assessment and escalate sensitive cases to the organization’s security and privacy teams.
- Review current prompt-minimization and data-retention practices before expanding long-context AI workflows.
Organizations should not place passwords, access tokens, private keys, or other secrets into AI prompts unless their security process explicitly permits it. A data exposure can require credential rotation when secrets are involved, but the organization’s incident-response team should decide the scope based on the actual data submitted. Similar concerns apply to third-party extensions and connected services, particularly after reports involving hijacked browser extensions showed how software dependencies can affect user data.
Cloudflare customers should contact Cloudflare support and their internal incident-response lead if they identify sensitive qualifying prompts. Stop short of making unsupported assumptions about which customer received data or whether any data was retained. The available information establishes 155 affected responses, not a complete map of every prompt fragment or recipient.
What does GLM-5.3 access look like after the incident?
Cloudflare’s current GLM-5.3 documentation lists the model as paid-only, with a 1,048,576-token context window. As of November 2, 2026, Cloudflare lists pricing of $1.40 per million input tokens, $4.40 per million output tokens, and $0.26 per million cached-input tokens. The current GLM-5.3 model page is the appropriate source for customers checking availability and pricing before deployment.
The restored public availability means Cloudflare considers the reported issue remediated, but it does not change the need for data controls. A larger context window can be valuable for analyzing extensive material, yet organizations should send only the content necessary for the task. Reducing unnecessary prompt content can limit the impact of an error in any AI processing system.
For most users, the incident is a reminder to treat AI prompts as a governed data channel rather than an informal workspace. AI tools can improve document analysis and coding workflows, but connected systems require permission reviews, retention policies, and clear rules for sensitive material. That concern is especially relevant as more AI products add file-editing features and direct access to user content.
FAQ
Did Cloudflare Workers AI leak customer prompts?
Yes, Cloudflare says its GLM-5.3 deployment returned data from another customer’s request in 155 responses. The reported exposure was limited to prompts longer than 681,280 tokens during the affected period.
When was the Cloudflare GLM-5.3 bug fixed?
Cloudflare says it remediated the issue on September 9, 2026, after declaring an incident at 13:22 UTC. Cloudflare made GLM-5.3 private at 14:00 UTC and restored public access at 19:40 UTC.
Did Cloudflare find evidence that attackers exploited the issue?
No, Cloudflare says it found no evidence of deliberate exploitation after excluding its own testing and the researcher’s testing. That finding does not eliminate the need for affected customers to assess sensitive long-context prompts.
Which Workers AI requests were affected?
Cloudflare says the issue affected GLM-5.3 prompts longer than 681,280 tokens. Ordinary short prompts do not meet the technical condition described in Cloudflare’s incident report.
What should organizations do after the Cloudflare Workers AI exposure?
Organizations should review qualifying GLM-5.3 requests from August 27 through September 9, 2026, and assess the sensitivity of submitted data. Organizations should involve security and privacy professionals when those prompts contained confidential information, personal data, or credentials.