Atlas AI security
A Cloudflare AI model sent some users pieces of other customers’ data. Here is how it happened.
Published October 29, 2026
Cloudflare, the internet company that also rents out AI models to developers, disclosed on October 26 that one of those models leaked data between customers. Cloudflare says that from August 27 to September 9, a small number of customers who sent very long requests to its GLM-5.3 model got responses containing text from other customers’ recent requests. Cloudflare counts 155 affected responses, says it found no evidence anyone exploited the bug on purpose, and fixed it on September 9.
What happened
Workers AI is a Cloudflare service where developers send a prompt (the text you give an AI model) to a model running on Cloudflare’s computers and get a reply back. Many customers share the same machines. Keeping each customer’s data walled off from the others is called tenant isolation, and that is what failed here.
To answer, a model first builds a working memory of your prompt, called the KV cache. Cloudflare runs this in two steps on separate groups of chips: one group reads the prompt and builds that memory (prefill), then hands it to a second group that writes the reply (decode). The software doing this is SGLang, a free, open-source inference engine, meaning the program that actually runs a model.
Cloudflare offered GLM-5.3 with a context window (the most text the model accepts at once) of 1,048,576 tokens, the small chunks of text models count in. But the prefill memory only had room for 681,280 tokens. Cloudflare says it knew about the gap before launch and expected oversized prompts to get an error. Its tests only checked that requests succeeded, not whether the answers made sense.
They did not get an error. A bug in SGLang marked the oversized prompt as rejected, swapped it for a one-token placeholder, and passed it along anyway. The decode chips then read memory pages that still held earlier customers’ prompts and partial answers, because those pages are not wiped between requests. The reply looked normal and came back as a success.
The bug was found by Gadi Evron, chief executive of the security firm Knostic, who reported it through Cloudflare’s bug bounty program on September 8. Knostic writes that the leaked replies it saw included personal names, company names, invoice numbers, euro amounts, payment dates and source code details. Cloudflare took the model offline within 40 minutes of declaring an incident, enlarged the memory, patched the engine, and restored it the same day.
Why it matters to a normal person
Most people never call Cloudflare directly. But apps you use often pass your text to a model hosted by some company you have never heard of. Knostic says it first noticed the problem while using OpenRouter, a service that forwards requests to many AI providers, and traced it to Cloudflare on September 7. So “which company holds my words” can be a longer chain than it looks.
It is also a reminder that AI leaks are not always the model misbehaving. This was ordinary plumbing: a size setting that did not match and an error that was not raised. The SGLang team says a related memory race could, under certain conditions, affect default split prefill-and-decode setups from early 2025 until its October releases, and Cloudflare urges operators running SGLang in that mode to update to version 0.5.22 or later.
What it does not mean
It does not mean every Cloudflare AI model leaked. Cloudflare says only GLM-5.3 was affected, and only prompts longer than 681,280 tokens, far longer than a normal chat.
It does not mean the model was trained on your data or remembered it. The leaked text was leftover working memory from requests made shortly before, not something the model learned.
It does not prove nobody misused it. “No evidence of deliberate exploitation” is Cloudflare’s own finding. Cloudflare’s report does not say how affected customers were told, a gap the security site SOCtember points out.
Related: Meta paused Muse chat sharing after researchers found shared chats in public web records, AI helped find two old flaws in PHP, which runs much of the web. The US now lists them as exploited.
Sources
- Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang — Cloudflare (primary source; Oct 26, 2026)
- SGLang security update: improving request isolation — SGLang team, LMSYS Org (primary source; Oct 26, 2026)
- Hallucination or cross-tenant: when an LLM answers with another user’s context — Knostic, the researcher who found the bug (Oct 27, 2026)
- Cloudflare says a Workers AI model returned 155 responses containing other customers’ data — SOCtember (secondary write-up of Cloudflare's report; Oct 27, 2026)