Cloudflare's AI answered 155 prompts with strangers' data — and reported success

Cloudflare disclosed Monday that its hosted GLM-5.3 model answered 155 prompts with data from other customers' requests between August 27 and September 9. Every affected prompt ran longer than 681,280 tokens — the size of the GPU memory pool holding prompts, which was smaller than the model's advertised 1,048,576-token context window.

The leak came from two stacked faults. Cloudflare knew about the pool mismatch before launch but trusted the engine to reject over-long prompts — and a bug in the open-source SGLang engine swapped rejected prompts for a one-token placeholder instead of erroring, so the model answered from memory pages still holding earlier customers' requests. The reply came back HTTP 200, a success code, with no error at all.

Security researcher Gadi Evron of Knostic reported the flaw on September 8; Cloudflare pulled the model within 40 minutes of declaring the incident and restored it the same day with a bigger pool and a patched engine. It found no evidence of deliberate exploitation — but admitted its pre-launch tests checked status codes and speed, never whether the output was actually correct.