Cloudflare AI bug: 155 replies held other customers' data
Why it matters
Cloudflare's incident report says that between 27 August and 9 September 2026, 155 Workers AI responses from the GLM 5.3 model contained data from other customers' requests made shortly before, all for prompts longer than 681,280 tokens. The cause was a prefill KV cache pool (681,280 tokens) smaller than the model's 1,048,576-token context window plus a bug in the open-source SGLang engine, so replies were generated from stale cache pages. A security researcher reported it via HackerOne; Cloudflare took the model offline within 40 minutes of declaring an incident and restored it with fixes on 9 September. It says it found no evidence of deliberate exploitation and recommends SGLang v0.5.22 or later.
Read the source: blog.cloudflare.com (opens in a new tab)
All hits from 27 Oct 2026More SecurityGet the daily hits by email