What happened
Cloudflare disclosed that the GLM-5.3 model it serves through Workers AI suffered a tenant isolation failure. The issue was reported on September 8, 2026 by security researcher Gadi Evron, with impact beginning on August 27.
According to the company, a small number of customers using GLM-5.3 received responses containing data from other customers' earlier requests to the same model. In total, 155 responses were affected, all of them to prompts longer than 681,280 tokens.
How the bug arose
Two problems overlapped. First, the configuration of SGLang, the open-source inference engine Cloudflare uses: the model was deployed with a 1,048,576-token context window, but the KV cache pool on its prefill GPUs only held 681,280 tokens.
Second, SGLang mishandled over-length requests in disaggregated prefill/decode mode. A prompt that did not fit the pool was internally marked as rejected and replaced with a one-token placeholder, but the request was not aborted. The decode node kept attending over stale cache pages from earlier requests and generated a response from them.
Remediation
Cloudflare took the model offline within 40 minutes of declaring an incident and restored service the same day with a corrected configuration and a patched inference engine. The KV cache pool now holds about 2.04 million tokens, roughly twice the context length, so a valid prompt never reaches the rejection path. The rejection path in SGLang was also made safe.
The company confirmed that no other model hosted on Workers AI was affected. It found no evidence of deliberate exploitation; the timing and volume of the affected requests were consistent with ordinary long-context use. Cloudflare published the report as a coordinated disclosure alongside SGLang and said it continues hardening its production deployments with upstream maintainers.
