AI and security briefsSecurity

Did Cloudflare Workers AI leak my prompts, and do I need to rotate my API key?

By Brandon Da Costa, founder of Digiton Dynamics

Published 28 October 2026Updated 28 October 2026Editorial policy

Cloudflare says 155 responses from its GLM-5.3 model on Workers AI contained other customers' request data between 27 August and 9 September 2026. Only that model and only prompts over 681,280 tokens were involved. The post doesn't tell customers to rotate API keys. If a secret sat in a prompt, rotate that secret.

Who should act: Anyone who sent prompts to @cf/zai-org/glm-5.3 on Workers AI between 27 August and 9 September 2026, and anyone who runs SGLang in disaggregated prefill and decode mode.

What happened

Security researcher Gadi Evron of Knostic reported through HackerOne on 8 September 2026 that very long prompts to the model sometimes returned text from other users' sessions. Cloudflare declared an incident at 13:22 UTC on 9 September, set the model to private at 14:00 and restored it at 19:40 after fixes. The exposure began at launch on 27 August (Cloudflare, 26 October).

Two things combined. Cloudflare ran GLM-5.3 with a 1,048,576 token context window but a KV cache pool of 681,280 tokens on its prefill GPUs. It knew of the gap and expected the engine to reject long prompts with an error. SGLang, the open source engine, instead passed rejected prompts to the decode node, which read cache pages still holding earlier users' prompts and partial generations. The client got an HTTP 200 and a coherent reply. A user had reported the same bug to SGLang on 6 July.

Cloudflare counts 155 affected responses, all to prompts above 681,280 tokens, reaching a small number of customers. It found no evidence of deliberate exploitation and says no other Workers AI model was affected. The post doesn't say whether tokens or other credentials appeared in leaked text.

Cloudflare worked with the researcher and, per SGLang's team, notified SGLang's maintainers on 9 September. Its public status page logged the incident from 14:25 to 20:09 UTC as Cloudflare Workers AI increased errors, with no mention of exposed data. That start is 25 minutes after the time the post gives for taking the model private. The post doesn't say Cloudflare contacted affected customers.

Who is affected

• Customers who sent GLM-5.3 prompts above 681,280 tokens in the window. Their responses may hold other customers' data.
• Customers whose requests ran shortly before such a prompt. Cloudflare says earlier requests to the same model supplied the leaked text. The post doesn't count them.
• Operators of disaggregated SGLang whose KV pool is smaller than their context window.

What we checked

Run on 28 October 2026 on the Mac that builds this site. Each command and its output are copied as they ran.

$ curl -s https://api.github.com/repos/sgl-project/sglang/releases/tags/v0.5.22 | grep -E '"(tag_name|published_at)"'
  "tag_name": "v0.5.22",
  "published_at": "2026-10-19T02:55:19Z",

$ curl -s https://www.cloudflarestatus.com/incidents/jsvvrtk5hvym | grep -o -E 'Cloudflare Workers AI increased errors|Sep 9, 2026, [0-9:]+ UTC' | sort -u
Cloudflare Workers AI increased errors
Sep 9, 2026, 14:25 UTC
Sep 9, 2026, 15:02 UTC
Sep 9, 2026, 20:09 UTC

SGLang v0.5.22, the release Cloudflare tells operators to run, exists and dates from 19 October. Cloudflare's status page logs the incident under a generic errors title, from 14:25 to 20:09 UTC on 9 September. No SGLang runs on this Mac.

What to do now

1. Ask Cloudflare support whether your account is affected, since the post lists no customers. Then search your logs for the model and window. Field names depend on your logging.

   jq 'select(.model == "@cf/zai-org/glm-5.3" and .usage.prompt_tokens > 681280)' requests.jsonl

2. Read each match for text that isn't yours. If you find some, delete it from logs, caches and downstream stores. If it held personal data, your privacy lead decides on notice.
3. Rotate any secret that appeared inside a GLM-5.3 prompt during the window. That rule is ours. Cloudflare doesn't tell customers to rotate Workers AI tokens.
4. If you run SGLang yourself, upgrade to v0.5.22 or later and compare the pool size in the prefill startup log with your context length.

   pip install --upgrade 'sglang>=0.5.22'
   grep -E 'max_total_num_tokens|context_len' sglang-prefill.log

5. Lower the context limit to fit the pool and confirm an over-length prompt returns HTTP 400.

What should have been in place

• A launch check that compares KV pool size with the advertised context length, read from the running engine. Cloudflare says it didn't enforce this one.
• Tests that read model output, not only status codes.
• A context limit set from measured capacity, not left to a proxy or the engine to reject.
• Secrets kept out of prompts.
• Dedicated inference for the most sensitive prompts.

Questions people ask

Digiton's production review traces what goes into each model call and which provider sees it, and the checks it runs are on the vibe coded app audit page.

How this brief was made: researched from the sources below, drafted with AI assistance and checked against each source on the dates shown. See the editorial policy.

Sources

1. Cloudflare, cross-request KV cache exposure in the GLM-5.3 Workers AI model, 26 October 2026, read 28 October 2026. https://blog.cloudflare.com/kv-cache-exposure-remediation/
2. Cloudflare status, Workers AI increased errors (9 September), 9 September 2026, read 28 October 2026. https://www.cloudflarestatus.com/incidents/jsvvrtk5hvym
3. SGLang team (LMSYS), SGLang security update: improving request isolation, 26 October 2026, read 28 October 2026. https://www.lmsys.org/blog/2026-10-26-cf-security
4. SGLang issue 30233, aborted prefill requests cause decode to generate garbage from incomplete KV cache, 6 July 2026, read 28 October 2026. https://github.com/sgl-project/sglang/issues/30233
5. GitHub, SGLang v0.5.22 release, 19 October 2026, read 28 October 2026. https://github.com/sgl-project/sglang/releases/tag/v0.5.22
6. Hacker News, discussion of Cloudflare's report, 26 October 2026, read 28 October 2026. https://news.ycombinator.com/item?id=50252159

More briefs

How these briefs are sourced and corrected. All AI and security briefs