Cloudflare published an incident report on October 26 about a bug in its Workers AI service: 155 responses from the GLM-5.3 model contained data from other customers’ requests between August 27 and September 9, 2026.

Every affected response followed a prompt longer than 681,280 tokens. According to coverage of the report, the model advertised a context window of 1,048,576 tokens while its cache pool held only 681,280, and a bug in the SGLang serving software generated output from stale cache pages instead of rejecting over-length requests.

Cloudflare restored the model on September 9 and found no other hosted model affected and no indication of deliberate exploitation. It has not said how many customers were affected.

Sources

Image: Chemicumi serverid 03.jpg by Ivo Kruusamägi, CC BY-SA 4.0, via Wikimedia Commons. Illustrative photo; it does not show the events described.