AI
Cloudflare says a long-context bug exposed data in 155 AI responses
Cloudflare disclosed that 155 responses from its GLM-5.3 Workers AI deployment contained data from other customers’ requests between August 27 and September 9, 2026. The exposure occurred only for prompts longer than 681,280 tokens, when a configuration mismatch and an SGLang rejection-path bug allowed stale GPU KV-cache pages to reach decoding. Cloudflare disabled and repaired the model, patched its infrastructure and urged operators using disaggregated SGLang to upgrade and verify cache ownership.
Editorial summary · Publisher article
What matters
- The affected model advertised a 1,048,576-token context, while the prefill KV-cache pool held only 681,280 tokens.
- Cloudflare says it found no evidence of deliberate exploitation and identified 155 affected responses after excluding testing and the researcher’s requests.
- The failure involved disaggregated prefill and decode nodes treating a rejected request as live and reading pages left by earlier requests.
- Cloudflare restored service after enlarging the pool, patching SGLang and adding deployment checks; it recommends SGLang v0.5.22 or later.
How stale cache pages crossed tenant boundaries
An over-length request was replaced internally with a one-token placeholder, but the distributed admission checks allowed it to proceed. The decode node believed the transfer had completed and read reserved pages that the request had not overwritten, exposing remnants of other sessions while returning a successful response.
Remediation and the remaining challenge
Cloudflare made the cache pool larger than the model context, moved rejection earlier in the engine, added lifecycle and transfer safeguards, and worked with SGLang maintainers on upstream patches. It is also developing page-level integrity checks and formal verification, because configuration checks do not guarantee that future memory-safety bugs are impossible.
Context & caveats
- This is Cloudflare’s own incident report; the packet does not include an independent investigation or affected-customer accounts.
- Cloudflare says corruption-detection coverage remains incomplete across model architectures.
Why this made the edition
Cloudflare provides a detailed incident account with a discovery timeline, affected request threshold, confirmed response count, technical root cause, remediation, upstream fixes and operator guidance. The source is first-party and therefore should be read as Cloudflare’s account, but it contains unusually concrete evidence and technical explanation of a serious tenant-isolation failure.
Source material