Cloudflare Discloses Workers AI Data Leak: SGLang Bug Caused 155 Cross-Tenant Mix-ups

US cloud provider Cloudflare published the investigation results of a data leak in its Workers AI service on October 28. The report states that between August 27 and September 9, the GLM-5.3 model mixed other customers' data into 155 responses. The issue stemmed from cache overflow during the processing of extremely long inputs. Cloudflare completed the fix on September 9, confirming that other Workers AI models were unaffected and no evidence of malicious exploitation was found.

The incident was reported by Gadi Evron, a researcher at security firm Knostic, on September 8. The investigation identified the root cause as a combination of Cloudflare's deployment settings and a bug in the open-source inference software SGLang. Cloudflare set the maximum input length for GLM-5.3 at approximately 1.05 million text units, but the GPU cache could only hold about 680,000 units. When inputs exceeded capacity, SGLang should have rejected the request but continued processing due to the bug, causing the receiving end to misread residual data from other customers left in memory and mix it into the response.

Cloudflare admitted that it knew before launch that the cache capacity did not match the configured input limit, but at the time only checked service status and performance without verifying the correctness of the response content. Additionally, users had reported related vulnerabilities in SGLang as early as July, but Cloudflare did not notice until after the incident occurred. Currently, Cloudflare has increased the GPU cache capacity to approximately 2.04 million text units and corrected the SGLang logic. The company recommends that enterprises using the same architecture update to version v0.5.22 released on October 19 or higher, and verify that cache capacity is sufficient to handle the maximum input length.