TL;DR
Was there a Cloudflare Workers AI data leak?
Cloudflare says one AI model it hosts, GLM-5.3, mixed bits of other customers' requests into 155 replies between August 27 and September 9. Only extremely long prompts to that one model were hit, and it's fixed. If you didn't use GLM-5.3 on Workers AI then, you don't need to do anything.
Was my data exposed in the Cloudflare Workers AI leak?
Probably not. Three things all had to be true for a reply to be affected:
- You used one specific model. The problem was limited to GLM-5.3, a text model from the AI company Z.ai, running on Workers AI, Cloudflare's service that lets businesses and developers rent AI models by the request. Cloudflare says no other model there was affected.
- You used it in a two-week window. The bug was live from the model's launch on August 27, 2026, until Cloudflare fixed it on September 9.
- Your prompt was enormous. Only prompts longer than 681,280 tokens (tokens are the chunks of text AI models read and bill by) were affected. That's far beyond a normal chat, email or document. It mostly applies to developers feeding whole codebases or huge files into the model.
Cloudflare counted 155 affected responses in total and says it found no sign that anyone exploited the bug on purpose.
If you only use ChatGPT, Claude, Gemini or similar apps directly, this incident didn't involve you.
How did the GLM-5.3 leak happen?
Cloudflare published the details on Monday, October 26, 2026, in a coordinated disclosure, meaning the company, the researcher who found the bug and the software maintainers agreed to go public together after the fix.
In plain words, two mistakes lined up.
First, a setting mismatch. Cloudflare advertised GLM-5.3 as able to handle prompts of up to 1,048,576 tokens, but the model's short-term working memory on its machines, called the KV cache, only had room for 681,280. Cloudflare knew about the gap before launch and expected the software to reject prompts that didn't fit.
Second, a bug in SGLang, the free, open-source software Cloudflare uses to run the model. In the kind of setup Cloudflare runs, SGLang didn't refuse an oversized prompt. It quietly swapped it for a tiny placeholder and kept going, and the reply was written from memory still holding leftovers of other customers' recent requests. No error warned anyone.
What did Cloudflare do about it?
| When (2026) | What happened |
|---|---|
| August 27 | GLM-5.3 launches on Workers AI with the setting mismatch. |
| September 8 | Security researcher Gadi Evron of Knostic reports the problem through Cloudflare's bug bounty, a program that pays outsiders to report security flaws. |
| September 9 | Cloudflare confirms the leak, takes the model offline within 40 minutes of declaring an incident, fixes the setting and patches the software, then brings the model back the same day. |
| September–October | SGLang's maintainers ship fixes in versions 0.5.20 to 0.5.22. |
| October 26 | Cloudflare and the SGLang team publish what happened. |
Cloudflare also admits its pre-launch tests only checked that requests succeeded, not that the answers made sense, and it now checks memory against the prompt limit before every change.
X reactions
Cloudflare summed up the cause in one line the evening it published its write-up, and the researcher who found the bug pointed people to it later that evening.
Our take
Small incident, big lesson. Hosted AI models run your text on shared machines next to other customers' requests, and providers promise to keep them apart. Here, a known setting gap plus a software bug broke that promise for 155 replies.
Cloudflare deserves credit for how it handled it: fast shutdown, a same-day fix, a detailed public write-up and an admission that its own checks missed it. Plenty of companies would have kept a 155-response leak quiet.
For a small business, the practical move isn't panic. It's habit. Don't paste anything into any AI tool that you couldn't live with leaking, like customer card details, passwords or private health information. Strip names from long documents where you can. And keep an eye on your AI provider's status and security pages, because the honest ones tell you when something goes wrong.
— Artificially Nerdy
What to do
- Most readers: nothing. If you never used GLM-5.3 on Workers AI between August 27 and September 9, you weren't affected.
- Developers who did use GLM-5.3 then: check your logs for prompts over 681,280 tokens in that window. If you had any, review what those prompts and replies contained, and contact Cloudflare support with questions.
- Anyone sending business data to AI tools: keep passwords, payment details and private customer records out of prompts, especially very long ones. Our rules for keeping an AI agent on a short leash cover more habits like this.
- Teams running their own AI models with SGLang: update to v0.5.22 or later and check your memory settings against your prompt limit, as Cloudflare recommends.
FAQ
Was Cloudflare hacked?
No. An outside researcher found the flaw and reported it through Cloudflare's bug bounty program. Cloudflare says it found no evidence anyone exploited it on purpose.
Can I still use GLM-5.3 on Workers AI?
Yes. Cloudflare restored the model on September 9, 2026, after fixing the setting and patching the software, and says it tested the fix against the researcher's own reproduction.
Could the same thing happen with other AI providers?
Other companies run SGLang too, and both Cloudflare and the SGLang team urged them to update. This bug is fixed in current versions, but every shared AI service relies on its software keeping customers apart.
What kind of data leaked?
Fragments of other customers' recent prompts and partial replies to the same model. Cloudflare doesn't describe what those prompts contained.
Sources
- Cloudflare: Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang — Cloudflare's October 26, 2026, incident report with the timeline, cause, 155-response count and fixes.
- SGLang team (LMSYS): SGLang security update: improving request isolation — the software maintainers' write-up of the bug and fixes for other operators.
- Cloudflare on X — Cloudflare's October 26, 2026, post (6:34 PM ET).
- Gadi Evron on X — the reporting researcher's October 26, 2026, post (9:41 PM ET).
- LMSYS on X — the SGLang security update post, October 26, 2026 (6:04 PM ET).
