Cloudflare disclosed on October 26, 2026 that its Workers AI service returned data from other customers' requests in 155 GLM-5.3 responses. The company's incident report says the exposure ran from August 27 to September 9, when it restored the model after fixes. It found no other Workers AI model affected and no evidence of deliberate exploitation.
The failure escaped tests that checked successful HTTP responses and performance without checking output coherence. For developers evaluating hosted inference, the distinction matters: an API can appear healthy while returning another customer's data.
A prompt could fit the advertised window and exceed memory
The SGLang team's accompanying disclosure describes a mismatch between Cloudflare's configured 1,048,576-token context window and a prefill cache with room for 681,280 tokens. Prefill processes the prompt; a separate decode worker generates the response using the transferred cache.
Requests beyond the cache capacity were marked for rejection, yet could still enter that handoff. Decode then read memory pages that hadn't been populated for the current request. SGLang says the single-node rejection path returned an error instead. This incident concerned its disaggregated serving path, where prompt processing and generation run separately.
Cloudflare says every affected response followed a prompt longer than 681,280 tokens. Its testing account acknowledges that engineers knew the capacity mismatch existed before launch, but assumed the engine could handle it. Cloudflare now compares the running engine's cache capacity directly with the context limit before deployment changes.
Rejection and interrupted transfers need separate checks
SGLang says its admission fix stops rejected requests before the handoff. Its disclosure also covers a related race: after an interrupted transfer, memory could be reassigned while writes from the previous request were still arriving. Deferred release holds that memory until drain acknowledgements arrive or a timeout expires. The team cautions that timeout expiry alone doesn't prove writes have stopped.
For operators, these mechanisms call for different checks. A capacity check asks whether a valid prompt fits. A rejection test asks whether an invalid request stops. An interrupted-transfer test asks when memory becomes safe to reuse. Successful-response counts alone answer none of those questions.
Cloudflare recommends SGLang 0.5.22 or later. SGLang's operator guidance recommends upgrading and watching deferred-release metrics after rollout. Almost all holds should end through a confirmed drain; frequent timeouts point to acknowledgement problems. That is a concrete signal to watch as operators deploy the fixes. This account follows the two teams' disclosures; MrKeyoor has not reproduced the failure or tested the patches.