Cloudflare published a full postmortem on Monday, October 26, disclosing that the GLM-5.3 model on Workers AI returned data from other customers' requests in 155 responses between August 27 and September 9, 2026. Cloudflare said no other Workers AI model was affected and that it found no evidence of deliberate exploitation.

Every affected prompt was longer than 681,280 tokens — the size of the prefill KV cache pool Cloudflare had provisioned — even though the model was deployed with a 1,048,576-token context window. A bug in the SGLang inference engine let over-length requests proceed and read stale cache pages instead of being rejected, returning a normal response built partly on another user's state.

Security researcher Gadi Evron of Knostic reported the flaw via HackerOne on September 8; Cloudflare reproduced it within a day, took the model offline, expanded the cache pool and deployed a fix the same day. The upstream SGLang fixes shipped in v0.5.22 on October 19.