In short: On 26 October Cloudflare disclosed that the GLM-5.3 model on its Workers AI service returned text from other users’ requests in 155 responses between 27 August and 9 September. The cause was an undersized cache combined with a bug in the model-serving software. The lesson for businesses: never send more personal data to an AI service than you need to.
On 26 October Cloudflare published a detailed write-up of an incident in which the GLM-5.3 model on Workers AI exposed parts of other users’ requests. It is a clear example of the risks that come with AI services, even from large and reputable providers.
What happened?
- on 8 September a security researcher reported that very long prompts to GLM-5.3 sometimes returned text from other users’ sessions;
- according to Cloudflare, the issue existed from the model’s launch on 27 August until the fix on 9 September;
- 155 responses were affected, all of them to prompts longer than 681,280 tokens;
- Cloudflare says there is no evidence of deliberate exploitation.
Why did it happen?
Two problems combined. First, the model’s KV cache held 681,280 tokens although the model allowed a context of up to 1,048,576 tokens – a mismatch Cloudflare knew about before launch. Second, a bug in the SGLang model-serving software meant an over-length request did not return a proper error but kept processing and read stale cache data from earlier requests. Cloudflare raised the cache to about 2.04 million tokens and fixed the bug; the fixes also landed in SGLang 0.5.21 and 0.5.22.
What should businesses using AI learn from this?
- Data minimisation. Send an AI service only what it needs to answer. Personal ID numbers, health data and trade secrets should be removed or masked before sending.
- Choose a transparent provider. A good provider discloses incidents, causes and fixes. Ask for a data processing agreement (DPA) and where data is stored.
- Keep a log. Know which data goes to which service, so you can quickly tell whether an incident affects you.
- GDPR duties. If a leak involves personal data, the controller generally has to notify the supervisory authority within 72 hours.
We have covered these principles in AI adoption in business and AI in CRM. When we connect AI to your website, CRM or online store, data protection is planned from the start – see AI solutions.
Frequently asked questions
Which Cloudflare customers were affected?
Users of the GLM-5.3 model on Workers AI whose prompts were longer than 681,280 tokens, between 27 August and 9 September 2026.
Has the leak been fixed?
Yes. Cloudflare fixed the bug and enlarged the cache on 9 September; the fixes also landed in the open-source SGLang releases 0.5.21 and 0.5.22.
Is it dangerous to use AI services?
Not if you use them thoughtfully: send only the data that is needed, choose a transparent provider and sign a data processing agreement.
Want to use AI with your data properly protected? Contact us.
