Skip to content

AI Compass / News

Cloudflare Workers AI: AI responses contained other customers' data

General

A configuration error and a software bug made the GLM 5.3 model return other customers' data in 155 responses: what you can take from it.

Source: Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang (Cloudflare Blog),

Note: My domain and this website run on Cloudflare. Cloudflare does not pay me, and the links are not affiliate links.

Technical drawing: requests from A and then from B run into a shared KV cache made of memory pages, hatched pages hold leftovers from A. The area read for B also covers some of these leftovers, so the response to B contains a hatched line, marked 155 ×.

What happened: On 26 October 2026, Cloudflare published a report on an incident in Workers AI, its service for running AI models through an API. According to Cloudflare, between 27 August and 9 September 2026 a small number of customers using the GLM 5.3 model received responses containing data from other customers’ requests. 155 responses were affected, all to very long prompts of more than 681,280 tokens (chunks of text). A security researcher reported the bug on 8 September. On 9 September, Cloudflare took the model offline, fixed the problem and restored it the same evening. Cloudflare says no other model was affected and it found no evidence of deliberate exploitation. These are the provider’s own statements.

What this means: The leaked data came from the KV cache, a buffer in GPU memory where the model keeps the part of the prompt it has already processed. It is not cleared between requests, only overwritten. With Cloudflare’s settings it ended up smaller than the advertised prompt length, and a bug in SGLang, the software that runs the model, did not abort over-length requests. As a result, the model read leftovers from earlier requests. Cloudflare sets out the cause, timeline and fixes in detail. The report mentions a status page update on 9 September. It does not say whether affected customers were notified individually.

What you can do:

  1. Check the contract: Send confidential or personal data only under a data processing agreement (DPA) with a clear rule on how quickly the provider tells you about incidents. Under Art. 33(2) GDPR, a processor must do so “without undue delay”.
  2. Send less: Put only what is needed into the prompt, and replace names, patient data or serial numbers with placeholders first (pseudonymisation).
  3. Ask: Find out from the provider how it separates caches between customers and how it tests that.

Context: Cloudflare admits it knew about the size mismatch before launch and that its tests checked only status codes and performance, not the responses themselves. For quality teams this is a familiar lesson: validation checks the result.

Bringing AI into your own team? That’s what my workshops are for. See the workshops