Cloudflare says its GLM-5.3 Workers AI model returned data from other customers’ requests in 155 responses between August 27 and September 9. Every affected response followed a prompt exceeding 681,280 tokens, and Cloudflare restored the model on September 9 after correcting its configuration and patching the software serving it.
Cloudflare says it found no indication that anyone deliberately exploited the flaw and confirmed that other Workers AI models were unaffected. After removing activity from its own tests and the researcher’s tests, the company judged the remaining requests’ timing and volume consistent with normal use of long prompts. Gadi Evron from Knostic reported the problem through HackerOne on September 8; Cloudflare reproduced it the following morning and disabled the model within 40 minutes after declaring an incident.
Read more: Cloudflare Launches Clairic Preview for Extracting Typed Data
The model accepted a context window of 1,048,576 tokens, but its prompt-processing GPUs had cache capacity for only 681,280 tokens. That left part of the configured context window beyond the capacity of the cache needed to process it. Cloudflare acknowledged knowing about the mismatch before launch, but said successful test responses led it to expect the inference engine to handle oversized requests safely.
A second failure involved SGLang, the open-source engine Cloudflare uses to run the model. When a prompt exceeded cache capacity, SGLang recorded a rejection and substituted a placeholder containing one token, yet continued passing the request between the GPUs processing prompts and those generating answers. The answer-generating GPUs treated the transfer as complete even though much of their assigned cache still contained earlier requests, allowing that data to influence responses.
Cloudflare increased the cache pool to about 2.04 million tokens, roughly double the model’s configured context length. It also patched the engine to stop rejected requests before memory allocation or cache transfer, and tested both changes using Evron’s reproduction script and its own marker-based checks before restoring access. SGLang has addressed the bug in v0.5.21.
Cloudflare said its earlier testing checked HTTP status codes and performance without checking whether long-context answers were coherent. It now checks the running engine’s cache capacity against the configured context length before shipping changes to deployments that separate prompt processing from answer generation.
