Cloudflare AI customers received other customers' data by mistake

On September 8 at 11:11 p.m. (UTC), a report arrived through Cloudflare's bug bounty program. Gadi Evron, of the security firm Knostic, described abnormal behavior: GLM-5.3, a language model Cloudflare offers on its Workers AI service, sometimes returned responses containing data from other customers' requests. The next day, Cloudflare's security teams reproduced the leak with two separate accounts.

On October 26, the company published a full account of the incident. Between the model's launch on August 27 and its fix on September 9, 155 responses contained data taken from requests that other customers had sent to the same model shortly before. A "small number" of customers are affected, according to Cloudflare, which does not name them and does not say whether they were notified. No other Workers AI model was affected.

A memory pool that was too small, and an error that returned nothing

To write its response, an AI model keeps in memory a representation of the text it has just read, the "KV cache." At Cloudflare, reading the request and writing the response happen on different machines. But the memory pool set aside for reading could hold only 681,280 tokens (word fragments), while the model accepted texts of 1,048,576 tokens. Cloudflare acknowledges that it knew about this gap before launch. It did not consider it a problem, because its tests on long texts returned success codes. The content of the responses, however, was not checked.

The second ingredient came from SGLang, the open-source software that runs the model. Faced with a request that was too long, it did not return an error: it replaced the request with a one-token text. The machine in charge of writing then worked with leftover memory from previous requests. All 155 faulty responses answered requests of more than 681,280 tokens.

No attack, but a lesson for shared AI

According to Cloudflare, the requests involved match, in their pace and volume, normal use of long texts, and nothing points to deliberate exploitation. On September 9, the model was pulled at 2 p.m., then restored at 7:40 p.m. (UTC). Its memory pool was raised to about 2.04 million tokens, roughly double the maximum length, and SGLang was fixed. The fix was merged into the open-source project in version 0.5.20 (September 18), then completed in versions 0.5.21 (October 2) and 0.5.22 (October 19).

The incident shows that, in a shared AI service, customers who do not know each other use the same machines and the same memory. A simple configuration error can cause a leak there, without any attacker.

What to check

If you used GLM-5.3 on Workers AI between August 27 and September 9, your requests may have appeared in another customer's response. If you sent it very long texts, you may have received other people's data. In both cases, contact Cloudflare. For companies that host models themselves with SGLang in disaggregated mode (reading and writing on separate machines), Cloudflare recommends:

• upgrading to SGLang 0.5.22 or later, which rejects requests that are too long before any transfer;
• comparing, at the startup of each machine, the size of the memory pool with the maximum text length, and repeating this check after any change of model or memory settings;
• enabling memory integrity checks (--disaggregation-enable-kv-checksum and --kv-canary) when the model supports it.

One question remains open: have the customers whose requests circulated been notified? Cloudflare's account says nothing about it.