Cloudflare admits to model memory leak: how cache pages exposed subscriber data
Cloudflare disclosed a security vulnerability in its Workers AI platform that caused sensitive data to leak between user accounts and code snippets belonging to some customers to appear in other customers' responses, due to a flaw in managing isolation of shared memory for the code-generation model GLM 5.3 belonging to Z.ai. The investigation followed a security report submitted by researcher Jady Efron of Nustic on September 8 2026 via HackerOne, where the company confirmed that 155 responses were affected by the leak between August 27 and September 9, all of which were responses to long prompts exceeding 681,000 tokens.
The root cause lies in the distributed inference architecture that the platform relies on via the open-source SG-Lang engine.Ultra-high speed required separating context processing from answer generation.where specialized graphics processing units read user inputs and build a key-value memory, then pass it through ultra-fast direct-memory access (RDMA) networks to other units dedicated to text generation; to achieve maximum computational efficiency, modern engines do not clear and zero memory pages between requests, but instead let previous data be automatically overwritten by new data when the full context is written, turning any flaw in memory page ownership management into a catastrophic exposure point.
Two technical errors coincided in this incident. The first was a server configuration flaw, where Cloudflare launched the model with a declared context of 1,048,576 tokens while the memory pool allocated to the initial reading units could hold only about 681,280 tokens. Although engineers were aware of this discrepancy, they assumed the engine would reject excess requests or handle them gradually, and they relied on checking web-protocol response codes in launch tests without scrutinizing the coherence and content of the generated texts. The second error was a vulnerability within the SG-Lang engine logic itself when processing overflow commands in the isolated server environment.
When the system received requests that exceeded memory capacity, the task scheduler chose to reject them and replace the massive context with a single placeholder token to discard the request without consuming processing resources. However, the acceptance queues in the generation servers checked for request completion rather than rejection, treated the task as pending and proceeded with reservation steps; eight memory pages were allocated but only one page was actually updated, while the remaining seven pages retained data from previous requests by other users.The engine read leftover memory pages and incorporated them into the new request's output.It returned an answer that appeared correct and was generated at unprecedented speed, but it was tainted with strangers' data.
The company acted quickly after the report was confirmed, disabling the model within 40 minutes and then reconfiguring memory allocation so that the reading pool could accommodate roughly 2.04 million tokens, thereby eliminating the rejection path entirely. In parallel, the company delivered a code fix in the SG-Lang core to reject non-conforming requests at the entry gates before any memory reservation, updates that were merged into engine versions 0.5.20, 0.5.21 and 0.5.22, with a call for all operators to upgrade immediately.
The technical lesson sends a direct message to infrastructure teams and cybersecurity officials in the Gulf, Egypt and the Arab Levant. Financial institutions and government agencies in the region are racing today to host open-source models locally and adopt distributed inference techniques to reduce computing costs and response times.The success of performance tests and fast response times does not guarantee security.The incident shows that relying on ordinary success codes in server protocols can hide a serious leak deep within shared graphics memory.
This disclosure requires engineers in regional data centers to re-audit memory-recycling policies in inference engines such as SG-Lang and update runtime packages to safe versions, alongside establishing rigorous tests that verify text consistency rather than merely performance metrics. Under the stringent personal data protection laws in Saudi Arabia and the United Arab Emirates, any cross-session leakage subjects an organization to a breach of confidentiality, making governance of the inference layer as critical as securing external network gateways.