An AI reply can succeed and still contain the wrong customer's data.

01The disclosure is new. The incident was earlier.

Cloudflare published its coordinated disclosure on 26 October, after an incident affecting GLM-5.3 on Workers AI from 27 August to 9 September. It reports 155 affected responses, all for prompts longer than 681,280 tokens, and says no other Workers AI model was affected. It restored the model on 9 September after remediation. [1]

Those are Cloudflare's reported scope and findings. This note is not a new incident discovery, an independent forensic assessment or a claim that every shared model server has the same flaw.

02Where the contract broke

Cloudflare describes two interacting problems: a prefill KV pool smaller than the advertised context window, and an SGLang rejection path that did not safely stop the disaggregated handoff. Decode could attend to cache pages that the current request had not overwritten. A normal-looking response could therefore conceal a data-isolation failure. [1]

Its pre-launch checks had relied on response status and performance rather than validating the content returned at long contexts. That is the transferable lesson: transport success, answer correctness and isolation are three separate checks. [1]

03What to ask before the next release

Swipe or scroll to compare

Cloudflare's report details configuration correction, earlier rejection, deferred release and transfer hardening. It recommends updating relevant SGLang deployments to v0.5.22 or later, or backporting the needed changes. Read its patch table rather than treating a version string alone as proof that your topology and configuration are safe. [1]

04For owners who buy inference rather than run it

You do not need to debug GPU memory. You do need a supplier who can identify the service you use, explain whether the disclosed configuration applies and provide a concrete remediation statement where relevant.

• Name the exact service and model, not just the vendor.
• Ask whether the incident's affected period or configuration intersects your usage.
• Ask what changed and what release checks now enforce isolation.
• Use the supplier's established security channel for account-specific questions; do not publish customer prompts in a support thread.
• Keep sensitive workloads within your approved handling policy while an applicability question remains unresolved.

05Do not test this with customer secrets

Any proposed validation should use synthetic markers in an environment you are authorized to test. This article does not provide an exploitation recipe, and no cross-account or production test was performed for it. A small successful test would still not prove the absence of every isolation defect.

Start with the report's What happened, Immediate remediation and Working with the SGLang team sections. The next decision is whether the evidence for your serving path is sufficient, not whether a different model can produce a faster demo.