Cloudflare AI bug sent some customers other people’s data: what happened and who is affected
A bug in Cloudflare's Workers AI service caused 155 responses from the GLM-5.3 model to include fragments of other customers' data. Here's what went wrong, who was affected, and why normal Cloudflare websites are safe.
Cloudflare, the company that protects and speeds up millions of websites, has disclosed a bug in its Workers AI service that caused some customers to receive pieces of other customers’ data in AI responses.
The good news: the problem was limited, fixed quickly, and did not affect normal websites that use Cloudflare. Here’s what happened, in simple terms.
What happened?
- Where: the GLM-5.3 AI model running on Cloudflare Workers AI, a service developers use to add AI to their apps.
- When: from August 27 (when GLM-5.3 launched) to September 9, 2026.
- How many: 155 responses contained fragments of data from other customers’ sessions. Cloudflare says “a small number of customers” were affected but didn’t give an exact number.
- Which requests: only prompts longer than 681,280 tokens, which is extremely long (roughly the length of several novels).
- Disclosed: October 26, 2026, together with the open-source project SGLang.
Cloudflare says it found no evidence of deliberate exploitation.
Is my website affected?
Almost certainly not. If you use Cloudflare for your website’s DNS, CDN, SSL or security protection, you were not affected. This bug only involved the GLM-5.3 AI model on Workers AI, and only for very long prompts. Cloudflare says no other Workers AI model was affected.
What went wrong? (simple explanation)
AI models use a short-term memory called a “KV cache” to process your prompt. Think of it as a whiteboard the model writes on while it works.
- A size mismatch: GLM-5.3 was advertised as handling prompts up to about 1 million tokens, but its “whiteboard” only had room for about 681,000 tokens. Cloudflare expected oversized prompts to simply return an error.
- A software bug: in the open-source SGLang system Cloudflare uses, oversized requests weren’t properly rejected. Instead, the model read old notes left on the whiteboard from other people’s requests, and returned an answer as if nothing was wrong.
- A testing gap: Cloudflare’s tests checked that the service responded quickly and without errors, but not whether the answers were correct.
The model didn’t “hack” anyone. It accidentally read leftover memory from other users’ requests, a classic example of how small configuration mistakes can cause privacy problems.
How was it found and fixed?
- September 8: security researcher Gadi Evron of Knostic reported it through Cloudflare’s bug bounty program.
- September 9: Cloudflare reproduced the leak within 25 minutes, made the model private, found the cause, fixed it and restored service the same day.
- Cloudflare made the memory pool about twice the size of the context window, and patched SGLang so oversized requests are rejected before any memory is shared.
- The fix was added to SGLang for everyone. Cloudflare recommends SGLang v0.5.22 or later.
What we still don’t know
- Exactly how many customers were affected.
- What kind of data was in the leaked fragments.
- Whether other companies running similar SGLang setups had the same problem before the fix.
Lessons for developers building AI apps
- Don’t send highly sensitive data to any AI API unless you really need to.
- Test output correctness, not just speed and status codes. Simple “canary” tests with unique markers can catch cross-user leaks.
- If you run SGLang yourself, upgrade to v0.5.22+ and make sure your KV cache pool is larger than your maximum context length.
- Watch for vendor security notices about the AI services you use.
This is the latest in a busy month for security news. Read our roundup: PHP, Railway, ConnectWise: the week the internet had a security crisis.
Frequently asked questions
Did Cloudflare have a data breach?
Not a hack. A bug in one AI model on Workers AI caused 155 responses to include fragments of other customers’ data. Cloudflare found no evidence that anyone exploited it on purpose.
Is my website on Cloudflare affected?
No. Normal Cloudflare website services (DNS, CDN, SSL, firewall) were not involved.
Which Cloudflare AI model was affected?
Only GLM-5.3 on Workers AI. Cloudflare says no other model was affected.
Is it fixed?
Yes. Cloudflare fixed it on September 9, 2026, and the fix was added to the open-source SGLang project.
