Cloudflare has restored the GLM 5.3 model on Workers AI after fixing a flaw that let some responses include data from other customers' requests. The company says 155 responses were affected between August 27 and September 9, 2026. Every affected response was to a prompt longer than 681,280 tokens.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare's HackerOne program on September 8. Cloudflare says it reproduced the exposure the next morning and took the model offline within 40 minutes of declaring an incident. It restored access on September 9 after changing the model's configuration and patching the SGLang inference engine.
A memory pool mismatch caused the exposure
The problem arose from a mismatch in capacity. Cloudflare offered a 1,048,576-token context window for GLM 5.3, but the GPU memory pool used to process prompts held only 681,280 tokens. When a longer prompt was rejected, a bug in SGLang's handling of work across GPUs allowed the response generator to read cached data left by an earlier request, according to Cloudflare.
Cloudflare increased the pool to about 2.04 million tokens and patched the engine so rejected requests stop before cached data is transferred. It says it checked both changes against the researcher's reproduction script and its own tests before restoring the model. The company has also added a deployment check that compares the pool size with the context window.
Cloudflare found no deliberate exploitation
Cloudflare says it found no evidence of deliberate exploitation. It confirmed that no other Workers AI model was affected and says it has applied the engine fix and further protections to all its production SGLang deployments.
The fix for this issue was released in SGLang v0.5.20, with follow-up changes in v0.5.21 and v0.5.22. Cloudflare recommends that operators running SGLang update to v0.5.22 or later. GLM 5.3 is available again on Workers AI as of September 9.
