Cloudflare discloses that a Workers AI cache vulnerability caused 155 responses to include other customers’ content; fixed

Article

Cloudflare AI User isolation failure:GPU Despite insufficient cache, it continued responding normally, 155 responses leaked other customers’ content

Beating AI News reported,Cloudflare disclosed a AI data breach. Its Workers AI platform’s GLM-5.3 model had a user-isolation vulnerability, causing 155 responses to include content previously submitted by other customers. In other words, information you send to AI may appear directly in a stranger’s response.

The issue was caused by GPU cache management.Cloudflare provided the model with an approximately 1050000 Token context window, but the GPU cache handling inputs could hold only approximately 680000 Token. Overlong requests should have returned an error immediately, but the underlying inference engine SGLang incorrectly continued execution, allowing the model to read residual cache from other users. The affected 155 responses all came from overlong requests exceeding cache capacity.Cloudflare admitted that it knew before launch that cache capacity was insufficient, but during testing it checked only whether the interface returned normally and did not verify the response content, thereby missing the data-mixing issue.

During their investigation, the two parties also found another type of cache vulnerability. After a user canceled a request midway, the system could allocate the cache to someone else prematurely while the original data had not finished transferring, after which it would overwrite the new user’s content. The SGLang team reproduced this using two H200 GPU:AI originally counted normally from 1, but after reaching 80, it suddenly began outputting the prompt from another request. This type of error would not even leave an exception log.Cloudflare fixed the actual data leak on September 9 and confirmed that other Workers AI models were not affected by the issue and that there was no evidence of malicious exploitation. SGLang subsequently fixed the related cache-management defects and recommends that affected deployments upgrade to v0.5.22 or later.

Original link https://m.theblockbeats.info/flash/373940

Key points

Cloudflare disclosed that the Workers AI platform’s GLM-5.3 model had a user-isolation vulnerability.
A total of 155 responses included content previously submitted by other customers, all from overlong requests exceeding GPU cache capacity.
The evidence states that the GPU cache could hold approximately 680000 Token, while the model’s context window was approximately 1050000 Token。
The underlying inference engine SGLang incorrectly continued execution when the cache was insufficient.
After a user canceled a request, premature cache allocation and content overwriting could also occur.
Cloudflare said it fixed the actual data leak on September 9 and that other Workers AI models were not affected and no evidence of malicious exploitation was found.
The SGLang team subsequently fixed the related cache-management defects and recommends that affected deployments upgrade to v0.5.22 or later.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

The system should have returned an error immediately when an overlong request exceeded the GPU cache capacity, but it actually continued execution, causing the model to read residual cache from other users; consequently, content from different customers could be mixed into responses.

Why it matters to readers

This type of cache-isolation failure could cause information submitted by one user to appear in a stranger’s response, affecting AI service’s data isolation and user trust.

If you submit sensitive information to the AI service, a cache-isolation vulnerability could allow other users to see the content; according to this evidence, the incident has been fixed.

Risks and unknowns

The evidence is a media account and does not include Cloudflare the original incident report.
The evidence does not specify the year corresponding to September 9.
The evidence does not disclose the identities of affected customers, the sensitivity of the content, or whether any regulatory or subsequent customer action occurred.
The evidence does not specify whether the actual SGLang-related fix versions were validated.

Cloudflare discloses that a Workers AI cache vulnerability caused 155 responses to include other customers’ content; fixed

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center