Cloudflare published a post-incident report on Oct. 26 about a tenant-isolation bug in GLM-5.3, an open model it hosts on Workers AI as @cf/zai-org/glm-5.3. Between Aug. 27 and Sept. 9, some customers who sent very long prompts got responses containing pieces of other customers' requests to the same model.
What went wrong
- Cloudflare advertised a context window of 1,048,576 tokens for the model. The memory pool on its prefill GPUs held only 681,280 tokens. Cloudflare says it knew about the mismatch but expected the engine to return an error for prompts that didn't fit.
- A bug in SGLang, the open-source inference engine Cloudflare uses, admitted those oversized requests in disaggregated prefill/decode mode instead of rejecting them. The decode servers then generated answers from stale memory pages that still held earlier users' data.
- All 155 affected responses answered prompts longer than 681,280 tokens. Cloudflare says no other Workers AI model was affected.
How it was found and fixed
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare's HackerOne bug bounty program on Sept. 8. Cloudflare took the model offline on Sept. 9, 40 minutes after declaring an incident. It deployed a corrected configuration and a patched engine and restored service the same day. The company found no evidence anyone deliberately exploited the bug.
What to do
The Injection reports that Cloudflare customers don't need to do anything. Teams running SGLang themselves in disaggregated mode should upgrade to v0.5.22 or later and check that their memory pool is at least as large as their context length.