Cloudflare has published a detailed account of a bug that exposed data across customers using one model on its Workers AI platform.

What happened

  • Model: GLM-5.3 on Workers AI.
  • Window: 27 August to 9 September 2026.
  • Impact: 155 responses included data from other users’ requests. Only very long prompts were affected.
  • Reported by: Security researcher Gadi Evron, on 8 September.

The cause

The model accepted prompts of up to 1,048,576 tokens, but the cache that holds conversation context (the KV cache) only had room for 681,280. That mismatch triggered a bug in SGLang, the open-source software used to run the model, and cache pages leaked between requests.

The fix

Cloudflare took the model offline, increased the cache to 2.04 million tokens and added a safe way to reject requests that don’t fit. It worked with the SGLang maintainers to fix the bug in the open-source software. Cloudflare says it found no sign of deliberate attacks.

tech.sydney itself runs on Cloudflare’s network, but not on Workers AI.