Cloudflare AI Data Leak: 155 Responses Carried Other Customers' Data, and 5 Questions for Your AI Provider

On October 26, 2026, Cloudflare published an incident report confirming that, between August 27 and September 9, 2026, 155 responses from the GLM-5.3 model on its Workers AI platform contained data from other customers' requests. Only very long prompts were affected, those above 681,280 tokens, and Cloudflare says it found no evidence of deliberate exploitation. The lesson for any company sending files to an AI service is direct: you share the provider's machines with strangers, and isolation between customers can fail. What to do this week: list every AI service your team uses, ask each provider the five questions below, and stop sending personal data that the task does not need. If you read our piece on AI models with no known owner, this incident shows that a well-known provider is no guarantee either.

What happened, in plain words

Workers AI lets companies pay per use for AI models running on Cloudflare's servers instead of buying their own. Cloudflare advertised a context window of 1,048,576 tokens for GLM-5.3, meaning the model could accept very long inputs. But the memory pool reserved for processing those inputs was sized for only 681,280 tokens. When a request was longer than that, the serving software (SGLang) should have rejected it with an error. Instead, it carried on and built the answer from leftover memory pages of earlier requests, and returned it as a normal successful response.

The result: a small number of customers received answers containing fragments of what other customers had sent. Cloudflare says the problem affected GLM-5.3 only, not its other models.

The timeline

• August 27, 2026: GLM-5.3 launches on Workers AI and the exposure begins.
• September 8: security researcher Gadi Evron of Knostic reports the problem through Cloudflare's HackerOne bug bounty programme.
• September 9, 13:22 UTC: Cloudflare declares an incident; at 14:00 UTC, 38 minutes later, the model is offline.
• September 9, 19:40 UTC: service restored after the memory pool was fixed and the serving software patched.
• October 26: public disclosure, coordinated with the SGLang maintainers and the researcher.

That is 13 days of exposure, discovered by an outside researcher rather than by Cloudflare's own monitoring. The report does not say whether the affected customers were notified individually.

Why this matters to a Saudi business that has never heard of GLM-5.3

Most companies now use AI through a shared service: a chatbot that reads customer messages, a tool that summarises contracts, a system that classifies invoices. In each case your text travels to servers that process requests from thousands of other companies at the same moment. The provider promises to keep them apart. This incident shows that this promise rests on configuration details that can be wrong, and that the error may give no sign: the affected customers got a normal answer, not an error message.

The trigger here was very long inputs. That is exactly the use many companies are moving towards: uploading a whole archive of contracts or a full year of correspondence in a single request.

Five questions to ask your AI provider

1. Is my data processed on shared machines or on capacity reserved for me? Reserved capacity costs more, but it removes this whole class of risk.
2. What do you do if a request exceeds the model's limit? The right answer is a clear rejection, not a silent truncation or a reply built on something else.
3. Within how many hours do you notify me of an incident that touches my data, and is that written in the contract? You need this to meet your own obligations.
4. Do you keep my prompts and responses, for how long, and where? Data that is not kept cannot appear in someone else's answer later.
5. Do you run a bug bounty programme or external security testing? In this case, an outside researcher was the one who found the flaw.

What Saudi law expects from you

If personal data of your customers or employees leaks through a provider you chose, the responsibility does not move to the provider. Article 24 of the Implementing Regulation of the Personal Data Protection Law requires notifying the competent authority within 72 hours of becoming aware of an incident that may harm the people concerned. A provider that tells you nothing, or tells you weeks later, puts you in breach of that window without your knowing. That is why the third question above is not a formality.

Steps for this week

• List every AI service your team uses, including free tools employees adopted on their own.
• If you used GLM-5.3 on Workers AI between August 27 and September 9, 2026, review your logs for very long requests in that window and contact Cloudflare.
• Remove names, ID numbers and phone numbers from texts before sending them, unless the task truly needs them.
• Split very large documents into reasonable requests instead of pushing the model to the edge of its limit.
• Add an incident-notification clause with a fixed number of hours to every AI service contract.

The Origami view

We do not read this incident as a reason to avoid shared AI services. Cloudflare took the model offline in 38 minutes and published a detailed, honest report, which is better than many providers would do. We read it as a reminder that the risk sits in the details that never appear in marketing pages: memory sizes, how errors are handled, who is watching. When we build AI systems for clients, we start with the question of which data needs to reach the model at all, then choose between a shared service and capacity hosted inside the Kingdom based on how sensitive that data is.

If you want a review of the AI services your company uses and of what data they receive, contact us, or see our services.

Sources

• Cloudflare — Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang, October 26, 2026: the 155 responses, the dates, the 681,280 and 1,048,576 token figures, and the response timeline.
• SDAIA — Implementing Regulation of the Personal Data Protection Law: Article 24 and the 72-hour notification window.
• Unite.AI: news coverage of the disclosure.