Cloudflare: its AI slipped other customers' questions into its answers, how is that possible?

You ask an AI a question, and pieces of someone else's question slip into its answer. A stranger, another customer, who wrote a few moments before you. It happened 155 times between August 27 and September 9 at Cloudflare, which has just told the whole story on October 26 in a report with a rather rare level of candor.

And the best part is the cause. Not a hacker, not an attack. An order book that was too small, in a kitchen where nobody had checked what was coming out of the plates.

The answer was for you, part of the content belonged to another customer

Who is affected?

You may not know Cloudflare, but you go through it every day: it's the company whose servers sit in front of a good part of the planet's websites, to speed them up and protect them. It also rents AI models to developers, with a service called Workers AI. In practical terms, a company that wants to put an assistant in its app, or an automatic summary on its site, can hook up a model hosted by Cloudflare instead of buying its own machines.

The model involved is just one: GLM-5.3, a Chinese model from the company Zhipu. And only in one very specific case: when the text sent exceeded 681 280 tokens. A token is a piece of a word, roughly three quarters of a word. So that's around 500 000 words, basically the size of War and Peace. All at once.

The bug was triggered only by submissions that size

So no, if you asked a chatbot for a lasagna recipe this summer, your recipe did not end up at the neighbor's place. The people who send texts like that are companies having entire contracts, years of emails or a software's complete code analyzed. Cloudflare talks about “a small number of customers”. But those are precisely the ones sending the most sensitive documents.

How can an AI mix up two customers?

To answer lots of people quickly, Cloudflare runs the model on two kinds of machines, like a restaurant. In the dining room, the maître d' reads your order in full and takes notes in a notebook. In the kitchen, a cook reads the notebook and prepares the plate, meaning the answer. These notes even have a name among specialists, the “cache”, and they are used so the whole order does not have to be reread with every word written.

The maître d's notebook could contain 681 280 tokens. But Cloudflare told customers that the model accepted up to 1 048 576 tokens, a little over a million. The notebook was therefore only two thirds of what was promised. So, when an order that was too long arrived, the maître d' refused it, wrote a single word on the first page to plug the hole, and still sent the notebook into the kitchen with the label “complete order”.

The cook, for his part, expected a very long order. So he read all the reserved pages. The first one was yours, almost empty. The next ones still contained the orders from the tables before, never erased. He cooked with all that, and you received a perfectly clean answer, with the code “everything is fine”, but with bits of other customers' questions and answers inside.

A refused page, then the pages still filled with the previous orders

The software that handles this back-and-forth is called SGLang. It's free, open-source software, with public code, and lots of companies use it to run their models. The bug came from it: a refused command should have been cancelled, with an error message, instead of being sent to the kitchen.

The worst part: they knew about the problem

It's the sentence in the report that made me sit up, and Cloudflare deserves credit for writing it itself: “We knew about this mismatch before the launch.” They knew that the queue was smaller than what they were announcing. They assumed the software would handle it properly. Their tests checked that the server responded, and that it responded quickly. Not that the answer was the right one!

And the software flaw wasn't unknown either: someone had reported it to the SGLang developers on July 6, seven weeks before the launch.

In short, this time it was a bit as if your mechanic knew the brakes were iffy, gave you the car back because it started properly, and had simply forgotten to test them.

The good side of the story

Because there is one, and a real one. The leak was found by a security researcher, Gadi Evron, from the company Knostic. He reported it on September 8 at 23:11 (Universal Time) through Cloudflare's bug bounty program, the system that rewards people who report a vulnerability instead of using it. What followed is impressive, so I'll give it to you hour by hour, still on September 9:

• 13:22: incident declared, and the leak reproduced 25 minutes later;
• 14:00: the model shut down for everyone;
• 14:35: the cause found;
• 19:40: the model returns, fixed, with a queue twice as large as the longest possible request.

Less than six hours of downtime. There are plumbers who take longer to call back! And Cloudflare says it found no trace of deliberate exploitation: the 155 responses looked like normal use, not like someone fishing for other people's secrets.

Then they waited. Why publish only on October 26? Because the bug was in SGLang, so potentially at every company that uses it. Cloudflare warned its developers, who published three fixed versions, the last one on October 19, with an automatic check of every submitted queue thrown in. The report only came out once everyone was able to protect themselves. That's what coordinated disclosure is called, and that's exactly how it should be done.

This kind of accident isn't a first, either. On March 20, 2023, ChatGPT showed some users the titles of other people's conversations, and may have exposed some payment information belonging to 1.2% of paid subscribers who were connected during a nine-hour window. Same family of bug: a cache system that returns the data to the wrong client. Three years later, the reports are much more detailed, and the fix is faster.

What I take away from this for you

The AIs you encounter in your bank's, insurance company's or online shop's apps almost never run at those companies themselves. They run on rented machines, shared between dozens of customers. Most of the time, it works very well. But the Cloudflare story reminds us that these shared machines can send something to the wrong recipient.

I myself use GLM-5.3 in my development tools, directly at its publisher, not at Cloudflare. Phew, actually. And that doesn't change my basic rule, which applies to all AIs: what I wouldn't put on a postcard, I don't paste raw into a chatbot. An account number, a medical file, a client's contract: black out the names and numbers first, or replace them with “X”. It takes thirty seconds, and the AI answers just as well. And while you're at it, take a look at your assistant's settings: most have an option so that your conversations aren't used to train the model, and so that they're deleted after some time.

Before asking an AI to explain a letter, black out the names and numbers

For me, Cloudflare comes out of this pretty well: the fault is real, the repair exemplary, and the report is more honest than many press releases. But to the team that launched GLM-5.3 knowing that the queue was too small: next time, taste the dishes before serving them too, not just the cooking time!

Sources

• Cloudflare, October 26, 2026: the complete report on the GLM-5.3 leak in Workers AI
• LMSYS, October 26, 2026: the SGLang security update
• Unite.AI: the 155 responses and the timeline
• OpenAI, March 2023: the March 20 ChatGPT incident

Article written with the help of Claude Code, proofread and corrected by me.