Cloudflare's AI leak: 155 replies carried strangers' prompts

Short answer: Yes, Cloudflare Workers AI leaked other customers' data. Between August 27 and September 9 2026, 155 replies from its GLM-5.3 model contained text from other users' requests, because of a config mismatch plus a bug in SGLang, the open-source inference engine it runs. The part nobody is saying loudly: that SGLang bug sat in a public GitHub issue for 62 days before a fix was merged, and our pull of PyPI data shows only 0.8% of SGLang downloads in the last 30 days were the release Cloudflare now tells everyone to run.

TL;DR: Cloudflare served GLM-5.3 with a 1,048,576-token context window on prefill GPUs whose KV cache only held 681,280 tokens, and every prompt over that line came back with pieces of someone else's session. The engine bug behind it was reported publicly as SGLang issue #30233 on July 6, 52 days before Cloudflare even launched the model, and the fix did not ship in a release until v0.5.20 on September 18. Of 1,789,484 SGLang downloads from PyPI between September 27 and October 26, 89.4% were pre-fix 0.5.x builds and only 14,056 were 0.5.22 or later, so if you self-host models, check your version tonight.

Key numbers

What	Number	Source, checked Oct 27 2026
Replies that contained other customers' data	155	Cloudflare blog
Days the leak was live on Workers AI	13 (Aug 27 to Sep 9)	Cloudflare blog
Advertised context vs real KV pool	1,048,576 vs 681,280 tokens	Cloudflare blog
Days from public bug report to fix merged	62 (Jul 6 to Sep 6)	Cloudflare blog
Days from public bug report to fixed release (0.5.20)	74 (Jul 6 to Sep 18)	PyPI release history
SGLang PyPI downloads, Sep 27 to Oct 26	1,789,484	PyPI stats (our pull)
Share on pre-fix 0.5.x builds	89.4%	Our pull, data.csv below
Share on 0.5.22+, the version Cloudflare recommends	0.8% (14,056)	Our pull, data.csv below

What actually leaked, in plain English

An LLM keeps a scratchpad of the prompt it is reading, called the KV cache. On big deployments that scratchpad lives in a shared pool of GPU memory pages, and pages are not wiped between customers because wiping costs speed.

Cloudflare split GLM-5.3 across two GPU pools: one reads the prompt (prefill), the other writes the answer (decode). When a prompt was too long for the prefill pool, SGLang quietly swapped it for a one-token placeholder instead of returning an error. The decode side had already reserved pages for the full prompt, got a "transfer complete" signal, and started answering while reading pages that still held other people's prompts and partial answers.

The customer got an HTTP 200, a token count that matched their prompt, and a coherent reply. No error. That is the scary bit: the failure looked exactly like success.

Cloudflare knew about the mismatch and shipped anyway

This is not us reading between the lines. Cloudflare's own write-up, by Kevin Flansburg and Michelle Chen, says the team "were aware of this mismatch before launch" and assumed the engine would throw an error. Their long-context tests checked status codes and speed, not whether the output made sense.

Credit where it is due: once security researcher Gadi Evron of Knostic reported it through HackerOne on September 8, Cloudflare reproduced it with two accounts in 25 minutes, pulled the model, and had it back up fixed by 19:40 UTC the same day. The incident response was fast. The pre-launch testing was the L.

Our read: every AI cloud is racing to advertise the biggest context window on the spec sheet. A 1M-token number sells. A 681K-token number that actually fits in memory does not. That incentive is the real root cause, and Cloudflare is just the one that got caught and wrote it up honestly.

The bug was public for 52 days before the model launched

Cloudflare says another SGLang user filed the same failure as issue #30233 on July 6 2026. GLM-5.3 went live on Workers AI on August 27. The fix (#36988) merged on September 6, and the first release carrying it, v0.5.20, landed on PyPI on September 18.

So the timeline reads: public bug report, then 52 days of nobody connecting it to their own production config, then 13 days of live leakage, then a fix that took 74 days total from report to release. Cloudflare says it had been flagging this class of KV cache memory-safety bugs to SGLang since v0.5.10, which per PyPI was months earlier.

Nobody blocked the fix. The data says the bottleneck was attention: a fast-moving open-source engine that ships a release roughly every two weeks, 6,224 open issues on GitHub as of this morning, and operators who do not read the tracker for the engine their product runs on.

Our data: almost nobody is on the fixed version

We pulled every SGLang download from PyPI for the last 30 days, broken out by version. 1,789,484 downloads. The version Cloudflare says to run, 0.5.22 or later, got 14,056 of them. That is 0.8%.

Big caveat, and we are putting it up front: one ancient build, 0.5.2 from September 2025, is 1,480,405 of those downloads on its own. That looks like CI pipelines or mirrors pinned to a year-old version, not humans. Strip it out and the picture is better but still rough: 309,079 downloads, of which 110,245 (36%) were on a fixed release, so about 64% were not.

Second caveat: a pre-fix version is not automatically leaking. This exact bug needs disaggregated prefill/decode mode and a KV pool smaller than the context window. But Cloudflare's own point is that pool size is computed at startup from leftover GPU memory, and "any change to quantization, tensor parallelism, CUDA graph sizes, or a future model version" moves it. Most teams have no alarm on that number.

Since 0.5.22 shipped, the upgrade curve is flat

SGLang 0.5.22 went up on October 16. In the 11 days since, excluding the 0.5.2 pin, 108,000 SGLang downloads happened, and 14,056 (13%) were 0.5.22. About 40% were on any fixed release. The rest pulled something older.

That gap is the whole story of open-source AI infrastructure in 2026: the fix exists, it is free, it is public, and the ecosystem still installs the old thing by default because a requirements file somewhere says so. Lowkey, the most dangerous line in your stack is a version pin nobody has looked at since spring.

Who wins and who loses

Losers: the customers whose prompts showed up in a stranger's reply. Cloudflare says it found no deliberate exploitation and the affected requests looked like ordinary long-context use, which is good news, but the people on the other end still got someone else's text.

Also losing: the "just call a hosted API, it is safer than self-hosting" pitch. The hosted API was the thing that leaked. If you send sensitive data to any multi-tenant inference endpoint, you are trusting that provider's page-ownership bookkeeping, and most providers will never publish a post-mortem this detailed.

Winners: open source, honestly. The bug, the fix, the PR numbers and the post-mortem are all public, so anyone can check their own stack. Closed inference stacks get the same class of bug and you will just never hear about it. Our bet: within a year, a canary test for cross-request leakage becomes a standard line in every enterprise AI security questionnaire. Read more of our coverage of the AI industry, the LLM hub and today's news.

What this means for you

If you self-host with SGLang, run pip show sglang right now and move to 0.5.22 or later. Then do the check Cloudflare skipped: compare the KV pool size SGLang prints at startup against the context length you advertise, and refuse to deploy if the pool is smaller.

Next, add a canary test: send two long prompts from two separate accounts, each with a unique marker string, and fail the build if either marker shows up in the other reply. That is roughly what Cloudflare now runs, and it costs you an afternoon. Grab our data.csv below to see which SGLang versions the ecosystem is actually installing.

If you are on a hosted API, ask your provider in writing whether they run a cross-request leakage test and which engine version they are on. Their answer tells you a lot.

Stuck upgrading an inference stack, a container that won't start, or an AI API error? Our paid fixes start at $49: fixed within 24 hours or a full refund.

Sources

• Cloudflare, Kevin Flansburg and Michelle Chen, "Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang", Oct 26 2026
• SGLang issue #30233, opened Jul 6 2026
• SGLang repository (6,224 open issues, 38,242 stars), checked Oct 27 2026
• PyPI, sglang release history, checked Oct 27 2026
• PyPI download statistics for sglang by version, Sep 27 to Oct 26 2026, pulled Oct 27 2026
• Knostic, Gadi Evron, researcher who reported the issue