Cloudflare's GLM-5.3 Returns Other Customers' Data in 155 Responses

What happened

Cloudflare has disclosed that its Workers AI platform served responses containing fragments of other customers' requests. According to the incident report Cloudflare published on 26 October 2026, the problem involved the GLM-5.3 model, a text model from Z.ai built for coding and agent-style tasks. The affected window ran from 27 August to 9 September 2026, and 155 responses were involved. Every one of them followed a prompt longer than 681,280 tokens.

Cloudflare's own explanation names two faults that overlapped. The first was a sizing mismatch. The model was deployed with a context window of 1,048,576 tokens, but the cache pool on the prefill GPUs held only 681,280 tokens. Cloudflare says it knew about this gap before launch. The second was a bug in SGLang, the open-source inference engine it uses. When a prompt did not fit the pool, SGLang marked it as rejected and swapped in a one-token placeholder, but it did not stop the request. The decoding GPUs then read cache pages that still held data from earlier requests.

The security researcher Gadi Evron of Knostic reported the problem through Cloudflare's HackerOne program on 8 September 2026, according to Unite.AI. Cloudflare reproduced it the next morning and took the model offline within 40 minutes of declaring an incident. It restored the model on 9 September after correcting the configuration and patching the engine.

Cloudflare says it found no evidence of deliberate exploitation. It excluded its own tests and the researcher's activity, and judged the remaining traffic to be consistent with normal long-prompt use. It also says no other model on Workers AI was affected. These are the provider's own findings. No independent audit is cited in the sources listed here.

Why it matters for businesses that automate work

Many automated tasks send long material to a hosted model: full contract sets, exported ledgers, long email threads, or a year of supplier correspondence. This incident shows that the text a model returns depends on the provider's serving system, not only on the prompt your team wrote. A workflow can be built correctly and still return material from another account if the serving layer fails.

The count is also worth reading carefully. The 155 figure is a count of responses, not of customers. The disclosure does not turn that count into a list of affected businesses, so a business cannot assume from the number alone whether its own data was involved.

What changes in practice

For most businesses, the change is in vendor questions and record-keeping rather than in the tools themselves. The steps below are practical starting points.

1. Record which model, provider and endpoint performs each automated task, along with the context length the vendor advertises.
2. Ask the vendor whether it has published incident reports for that model, and how it keeps customer requests separate during processing.
3. Keep the most sensitive documents out of very long prompts until the vendor's answers are in writing.
4. If your own team runs SGLang or another self-hosted engine, compare the cache pool size with the context length after every change, and install the fixed upstream release described in the SGLang maintainers' update of 26 October 2026.

Automation cannot judge on its own whether a response belongs to the right customer. A workflow only catches a foreign name or account number if someone has built a check that compares the output with the job's own records. Without that check, a person still needs to read anything that leaves the business.

What to watch next

Watch for any further detail from Cloudflare, particularly on how many distinct customers were affected. Watch also for independent review of the SGLang changes, since the fix is described by the people who wrote it. Any regulatory or legal follow-up is not reported in the sources listed below, so none is assumed here.

For operations leaders, the test is simple. Ask every AI vendor the same three questions: which model is serving the work, what its context limit is, and how it has responded to past incidents. The answers belong in the vendor file before the next document goes through.