Every office fridge has one: the shared container that somehow ends up holding a bit of everyone's lunch. Cloudflare just published a detailed post-mortem on the AI version of that container, and it's required reading for anyone piping customer data into a hosted model.
Over-Length Prompts, Under-Sized Memory
Cloudflare disclosed that its Workers AI deployment of GLM-5.3, a text generation model from Z.ai, exposed data across customers between August 27 and September 9, 2026. A total of 155 responses — all to prompts longer than 681,280 tokens — contained data from other customers' requests made to the same model shortly before. The company says a small number of customers were affected and that it "found no evidence of deliberate exploitation."
The root cause was two problems stacked on top of each other. The model advertised a context window of 1,048,576 tokens, but its prefill KV cache pool held only 681,280, and a bug in the SGLang inference engine quietly swapped over-length prompts for a one-token placeholder instead of returning an error. The decode side then attended over cache pages left behind by other requests. A researcher reported it through HackerOne on September 8, and the model was taken private and restored the next day with fixes.
Two Holes in the Swiss Cheese
The uncomfortable detail: the SGLang bug had already been reported upstream on July 6, and Cloudflare says it knew about the context-versus-cache mismatch before launch but didn't verify that oversized prompts would be rejected. Nobody did anything cartoonishly wrong — two reasonable-looking assumptions just lined up perfectly.
The takeaway for businesses isn't "avoid AI providers." It's that AI infrastructure is young software with the same old failure modes — memory reuse, silent error handling, config drift — except the thing leaking is whatever your users typed in. Cloudflare's fixes double as a checklist: a cache pool sized at roughly twice the context length, rejected requests that fail loudly, pre-deployment checks comparing pool size to context window, and a recommendation that operators run SGLang v0.5.22 or later.
Credit where it's due: a 155-response leak with a public, line-by-line root-cause analysis beats a quiet patch every single time.
If your AI rollout plan hasn't yet asked "what exactly happens to our data inside the provider's stack?", our free AI implementation guide is a good place to start planning with your eyes open.
Source: The Cloudflare Blog