Cloudflare stock reports 155 Workers AI data exposures

Published on 10/30/2026 at 11:27 | Editorial responsibility: Rafael Müller, Editor-in-Chief AD HOC NEWS

Cloudflare stock remains in focus after the company disclosed a Workers AI isolation flaw. The model was restored after configuration and engine fixes.

Security disclosure raises infrastructure questions

Cloudflare said its GLM-5.3 Workers AI model returned fragments from other customers' requests in affected responses.
The company restored the model after enlarging the cache pool and patching the SGLang inference engine.
Cloudflare said it found no evidence of deliberate exploitation and confirmed that no other Workers AI model was affected.

NET, US18915M1071, Illustration mit AI erstellt.

Cloudflare disclosed on Monday, October 26, that a tenant-isolation flaw in its GLM-5.3 model on Workers AI caused some responses to contain data from other customers' requests. The company said the exposure ran from August 27 to September 9, when it restored the model after deploying a corrected configuration and a patched inference engine. The details were published in a Cloudflare incident report.

Cloudflare said the issue affected 155 responses, all associated with prompts longer than 681,280 tokens. The company said the responses could include data from other users' GLM-5.3 sessions. After excluding its own testing and the security researcher's requests, Cloudflare said the remaining activity matched ordinary long-context use and that it found no evidence of deliberate exploitation.

Two failures caused the exposure

The incident involved both a capacity mismatch and a software error. Cloudflare had configured GLM-5.3 for a context window of 1,048,576 tokens, while the key-value cache on the prefill GPUs could hold only 681,280 tokens. The company said it knew about the mismatch before launch but expected the inference engine to reject requests that exceeded the available cache.

That safeguard failed in SGLang's disaggregated prefill and decode setup. An over-length request was marked as rejected and replaced with a one-token placeholder, but the request continued through the handoff between the two GPU groups. The decode node then read cache pages that still contained material from earlier requests and returned a successful response instead of an error.

Security researcher Gadi Evron of Knostic reported the issue through Cloudflare's HackerOne program on September 8. Cloudflare said it reproduced the problem the following morning, took the model offline within 40 minutes of declaring an incident, and restored public access later that day after testing the fixes.

Remediation limits immediate risk

Cloudflare enlarged the prefill cache pool to about 2.04 million tokens, roughly twice the model's context length. It also changed the rejection path so that requests are stopped before memory allocation or cache transfer. The company said it applied the engine fix and additional safeguards to every model it serves with SGLang.

The upstream SGLang project released related fixes in versions 0.5.20, 0.5.21 and 0.5.22. Cloudflare recommends version 0.5.22 or later for operators using disaggregated prefill and decode. The company also said it now requires deployment checks that compare cache capacity with context length and monitor transfer integrity.

Cloudflare stock traded at 270.30 euros on Lang & Schwarz at 11:14 Berlin time on Friday, October 30. Investors may weigh the completed remediation against the broader challenge of proving tenant isolation as AI workloads use larger context windows. The real-time quote of Cloudflare stock is available separately.