Cloudflare’s disclosure makes cross-tenant cache isolation a concrete buying question
Cloudflare reported that 155 responses from one Workers AI model contained another customer’s data during an August–September incident, now remediated with SGLang.
Cloudflare’s October 26 disclosure concerns an earlier, remediated incident: between August 27 and September 9, 155 responses from GLM-5.3 on Workers AI included another customer’s data.
That is a count of responses, not affected customers. Cloudflare says other Workers AI models were not affected and it found no evidence of intentional exploitation. [1]
The failure crossed the boundary between the servers that prepare a long prompt and those that generate its response. A request exceeding the preparation server’s cache limit was rejected, but the distributed system could still hand off stale cache contents. The upstream SGLang account describes fixes to request isolation and cache lifetime. [1][2]
Ask inference providers how rejected and cancelled requests release memory, how tenant boundaries are tested under load, and whether distributed serving changes the isolation guarantees. For self-hosted systems, compare the upstream advisory with the exact serving topology and deployed revision. The relevant control is correct ownership of request state, not merely which model weights are loaded. [2]
Take it further
Review the upstream isolation advisory for your serving configuration For operators of SGLang-based inference. Check topology and applied fixes; this report does not imply every SGLang deployment was exposed.
Sources & details 2 sources
Discuss in your voice app
Take the reporting, visual explanations and original sources into a conversation. Copy the brief, paste it into your preferred assistant, then start its voice mode.
Paste the brief into your voice app to discuss this reporting.Reporting sources
- Cloudflare · Incident scope and remediation
October 26 disclosure; event window August 27–September 9, 2026. 155 responses, not customers.
- LMSYS/SGLang · Request isolation fixes
October 26 upstream technical account. Corroborates mechanism and fixes; coordinated with Cloudflare, not an independent audit of customer impact.
Images & figures
Rejecting a prompt is insufficient if stale state can still reach response generation. The repair must end the request’s handoff.
Euangelion · Source · Usage terms