Yes, a Cloudflare service exposed customer data, and the company says so in writing. Between August 27 and September 9, 2026, a small number of customers using GLM-5.3 on Workers AI received responses containing data from other customers' requests made to the same model shortly before theirs. Cloudflare published its postmortem on October 26, 2026, and the story reached wider coverage on October 28, when The Neuron's daily digest flagged it. It is a story about shared infrastructure, and it is worth understanding before your own prompts end up on someone else's invoice.
What happened and when
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare's HackerOne program on September 8, 2026. Cloudflare set GLM-5.3 to private on September 9 and restored it the same day, after resizing the pool and applying an engine patch. The post says the exposure was present from the launch. Its title is "Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang" (Cloudflare's postmortem).
The cause had two parts. The first was a misconfiguration: the KV cache pool on the prefill GPUs held 681,280 tokens, while GLM-5.3's context window is 1,048,576 tokens. The second was an SGLang bug. Over-length requests were marked rejected but not aborted, so prefill processed a placeholder while the decode node attended over stale KV cache pages from earlier requests. Cloudflare counted 155 affected responses, all to prompts longer than 681,280 tokens, and said the requests it identified are consistent with ordinary long-context use rather than repeated exploitation.
The fix and the version question
Cloudflare resized the prefill pool so it can hold the full context window, and says it now holds about 2.04 million tokens. The SGLang patch shipped in v0.5.20, with follow-ups in v0.5.21 and v0.5.22, and Cloudflare "highly recommend[s]" that operators update to v0.5.22 or later. One caution: the post says the patch landed in v0.5.20 and also that v0.5.21 addressed the prompt-length bug. Read the SGLang changelog yourself rather than trusting a single version number. Cloudflare's next steps include page-level integrity checks in SGLang and formal verification of its RDMA-based KV cache transfer protocol.
What it means for solo operators and marketers
Most of us will never run a GLM-5.3 cluster. We do send prompts to shared inference, though, which means client briefs, customer lists and pricing sheets share hardware, caches and scheduling with strangers. A vendor's privacy policy is only half the picture; cache behavior is the other half, and few of us read it. Three moves are worth making this week. Ask every AI provider whether prompt and KV caches are isolated per tenant. Check whether your own stack pins inference engine versions, because "we updated eventually" is how bugs live for weeks. And if you pitch AI services to agencies or clients, expect this question on procurement checklists before long.
Our take
Cloudflare deserves credit for doing this properly. A dated timeline, a named reporter, a clear root cause and the admission that the bug existed from launch is what a postmortem should look like. The uncomfortable part is that 155 responses sounds small until you remember each one is a real person's data. That launch sentence is the one to underline: the exposure was there from day one, and an outside researcher caught it. I spent years on the marketing side of analytics, including co-founding Urchin, and I have watched shared platforms learn the hard way that multi-tenant is cheap right up until it isn't. My prediction is that per-tenant cache isolation becomes a standard line in AI vendor questionnaires within a year, and the providers who answer it crisply will win the enterprise deals. This is a serious subject, so I will keep the humor to a minimum. Your vendor questionnaire should not be so restrained.
Sources
Cloudflare, "Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang" (October 26, 2026): blog.cloudflare.com. Wider coverage: The Neuron daily digest, October 28, 2026. All figures above come from Cloudflare's post.