On October 26 Cloudflare published a detailed account of a data exposure in Workers AI, its service for running AI models through an API. The problem affected one model, GLM-5.3, between August 27 and September 9, 2026. In 155 responses, the model generated text using data left over from earlier requests, which could include other users' prompts and partial answers.
What went wrong
Two problems combined. Cloudflare had set up GLM-5.3 with a context window of 1,048,576 tokens, but the memory pool that holds the model's working state (the KV cache) only had room for 681,280 tokens. A bug in SGLang, the open-source serving software Cloudflare uses, meant that requests longer than that were treated as successful instead of being rejected. The model then continued from stale cache pages left behind by earlier requests to the same model.
That is why only prompts longer than 681,280 tokens were affected. Cloudflare says only a small number of customers sent such requests, that they looked like ordinary long-context use, and that it found no evidence of deliberate exploitation. No other Workers AI model was affected.
How it was found and fixed
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare's bug bounty program on HackerOne late on September 8 (UTC). Cloudflare reproduced it with two separate accounts the next day, made the model private at 14:00 UTC on September 9 and restored it at 19:40 UTC.
The fixes include a cache pool large enough for the full context, about 2.04 million tokens; changes to SGLang so that over-length requests are retired before any data is transferred; checksums on cache transfers; and new deployment checks that compare memory size with context length. The SGLang changes have been submitted to the open-source project. The write-up does not describe how affected customers were notified.
What this means if your business uses hosted AI APIs
Treat every prompt as data you share with a vendor. Even with a large, reputable provider, a serving bug can expose it to someone else. Send only what the task needs, and strip customer names, credentials and secrets before they reach the model.
Be careful at the limits. This bug only hit requests at the far end of the advertised context window. If you push very long documents through an API, consider splitting them into smaller requests rather than relying on the maximum.
Check how a provider handles incidents. When choosing an AI provider, look for a public bug bounty and detailed post-mortems like this one. If you sent prompts longer than 681,280 tokens to GLM-5.3 on Workers AI between August 27 and September 9, ask Cloudflare whether your requests were among those affected.