Cloudflare Workers AI leaked other customers' prompts for two weeks after GPU memory mismatch

What happened

Between August 27 and September 9, a small number of responses generated by the GLM-5.3 model on Cloudflare's Workers AI platform contained fragments of prompts submitted by other customers. According to a summary of Cloudflare's October 26 incident report published on dev.to, 155 responses were affected, and all of them answered prompts longer than 681,280 tokens. There was no attacker and no external breach — the leak originated inside the inference stack itself, from a mismatch between what the model promised and what the hardware could deliver.

A context window the GPUs could not honor

The model advertised a context window of roughly one million tokens, but the KV cache pool on the GPUs serving it only held 681,280. As the report describes, the open-source inference framework SGLang sizes that pool at startup from whatever GPU memory remains after the model is loaded, and nothing in the deployment compared the resulting capacity with the context length the model claimed to support.

A second failure turned the mismatch into a leak. When an over-length prompt arrived, SGLang's disaggregated prefill and decode path flagged the request as rejected but never aborted it. Per the dev.to account, the decode node then produced output from stale cache pages that still contained data from earlier requests, which is how pieces of one customer's prompt ended up inside another customer's answer.

How Cloudflare handled it

Security researcher Gadi Evron reported the problem through HackerOne on September 8. Cloudflare declared an incident the following day, reproduced the behavior within 25 minutes, and pulled the model within 40 minutes. The fix was rolled out to every node, and service was restored the same evening. Cloudflare then worked with SGLang's maintainers on upstream fixes that shipped in releases from v0.5.21 onward, and closed the loop on October 26 with a postmortem that names its own mistakes alongside the framework's.

What to do if you were exposed

The report's guidance, as relayed on dev.to, is straightforward:

• Customers who submitted prompts above roughly 681,000 tokens to GLM-5.3 on Workers AI during the affected window should contact Cloudflare support about their accounts.
• Operators self-hosting SGLang with disaggregated serving should upgrade past v0.5.22.

Why it matters

Cross-tenant data leakage is among the most serious failure modes a shared inference platform can have, and this incident shows it can happen with no malicious actor involved — a silent gap between two configuration numbers was enough. Nor is the mechanism exotic: deriving cache capacity from leftover GPU memory at startup, without validating it against the advertised context window, is a pattern other self-hosted stacks could easily repeat. The broader lesson is that a model's claimed context length belongs to the model, while the context it can actually serve depends on the hardware underneath it, and the second figure deserves its own verification. Cloudflare's handling — reproduction inside half an hour, remediation within the day, upstream fixes and a candid postmortem — is also a useful reference point for how quickly a well-practised incident process can contain this class of bug once someone reports it.