Alert issued for AI model flaw

An alert was issued on September 8, 2026, after a security researcher reported unusual behavior in the GLM 5.3 model, developed by Z.ai and accessible to developers through Cloudflare's AI platform, Workers AI. The issue involved the model returning text from other users' sessions when given very long queries.

Flaw traced to software misconfiguration

Cloudflare's report, published on October 26, explained that the problem originated from a misconfiguration and a bug in the open-source software SGLang, used to run AI models on servers. This software is responsible for managing memory on graphics processing units (GPUs) when handling queries.

Memory management led to data leakage

The process involves a language model reading a query and storing an intermediate version in GPU memory, known as the KV cache. This memory is divided into pages assigned to each query. If SGLang cannot correctly track which query each page belongs to, data from one user could appear in another's response. Cloudflare noted that while the model could handle queries slightly over one million tokens, the hardware could only process up to 681,280 tokens.

Internal testing missed the issue

Cloudflare stated that its teams were aware of the hardware limitation but believed SGLang would reject overly long queries. Their testing focused on ensuring the service did not return error messages, without examining the content of the responses. However, SGLang did not reject these queries as expected.

Response process caused unintended data sharing

Cloudflare's system divides query processing between two groups of machines: one reads the query, and the other writes the response. When faced with an overly long query, the first group would replace it with fabricated short content without informing the second group. This led to the second group looking for the query's continuation in memory pages that still contained other users' data, potentially leaking fragments of those queries.

Incident contained, but risks remain

Cloudflare confirmed no evidence of deliberate exploitation and assured that other models were unaffected. It blocked public access to GLM 5.3 for less than 40 minutes after the alert and restored it later the same evening after increasing available memory and fixing the software. The bug had been reported to SGLang developers in July, and Cloudflare urges all users of the software to upgrade to version 0.5.22, released on October 19.

Future vulnerabilities anticipated

Cloudflare acknowledges that the fixes reduce but do not eliminate risks, and it estimates that "the next bug will have an unprecedented form." The company is working with SGLang developers to create a mechanism that prevents queries from accessing memory pages that do not belong to them.