Cloudflare AI User Isolation Fails: Insufficient GPU Cache Triggers Normal Responses, 155 Replies Leak Other Customers' Content

Insight Beating AI Flash News: Cloudflare has disclosed an AI data breach. A user isolation flaw in its Workers AI platform’s GLM-5.3 model led to 155 responses mixing content previously submitted by other customers—meaning messages you send to the AI could appear directly in strangers’ outputs. The issue traces to GPU cache management: Cloudflare set a 1.05-million-token context window for the model, but the GPU cache handling inputs only holds ~680,000 tokens. Long requests that should have triggered an error instead ran via underlying inference engine SGLang, letting the model read residual cache from other users. All 155 affected responses came from long requests exceeding cache capacity. Cloudflare admitted it knew the cache was insufficient pre-launch, but tests only checked for normal interface responses, not verifying content, so missed the data leakage. Joint troubleshooting uncovered another cache flaw: when a user cancels a mid-process request, the system may allocate cache to another user early, while original data is incomplete, then overwrite the new user’s content. The SGLang team reproduced the issue with two H200 GPUs: the AI, normally counting from 1, suddenly started outputting prompts from another request. Such errors leave no abnormal logs. Cloudflare fixed the actual leak on September 9, confirmed no other Workers AI models were affected, and found no evidence of malicious exploitation. The SGLang team has since patched related cache management defects, recommending relevant deployments upgrade to v0.5.22 or newer.