How One AI Bug Exposed Sensitive User Prompts

Cloudflare patched a critical vulnerability in its Workers AI platform that caused one of its models to leak sensitive data between different users.

Cloudflare recently disclosed and patched a significant security flaw on its Workers AI platform, as detailed in a company blog post. A security researcher alerted the company to a tenant isolation issue affecting one specific large language model, `@cf/zai-org/glm-5.3`. The vulnerability allowed data to leak between different, unrelated users. For a period of approximately two weeks, a small number of user sessions could have inadvertently exposed parts of their prompts or the model's responses to other users. Cloudflare quickly took the affected model offline, investigated the root cause, and deployed a fix before restoring service. The company confirmed that no other models on its platform were vulnerable to this particular issue. The transparent handling of the incident provides a crucial case study for the emerging field of AI infrastructure security.

The root of the problem was a novel vulnerability described as a "cross-request KV cache exposure." To understand this, it helps to know how large language models work during inference. To generate text quickly and efficiently, models use a mechanism called a Key-Value (KV) cache. This acts as a short-term memory, storing intermediate calculations from the user's prompt so they don't have to be recomputed for every new word generated. In a multi-tenant environment like Workers AI, where many different users share the same underlying hardware, it is absolutely critical that each user's KV cache is kept completely separate. The bug in the GLM-5.3 model's implementation caused this separation to fail. A memory buffer was not being properly cleared between requests, creating a situation where a new user's session could accidentally be seeded with data left over from a previous user's session, leading to the data leak.

This incident serves as a stark warning for the entire AI-as-a-service industry. Major cloud providers and AI companies all rely on multi-tenancy to make their powerful models economically viable for a broad customer base. The efficiency gains from techniques like KV caching are essential to this business model. However, the Cloudflare vulnerability demonstrates that these very optimizations can introduce subtle but severe security risks. It highlights a new attack surface that goes beyond traditional application security, residing deep within the complex machinery of AI inference engines. Security teams at all major AI providers are now likely re-evaluating their own systems for similar cache-related vulnerabilities, as this incident sets a precedent for a new class of potential data-exposure bugs specific to shared AI infrastructure.

For developers, CTOs, and security leaders building on top of third-party AI platforms, this event underscores the critical importance of supply chain security. The integrity of your application can be directly compromised by a flaw in the underlying model or its serving infrastructure. It is a reminder that even with a trusted vendor, blind faith is not a strategy. The key takeaway is the need for diligence in evaluating provider security and having incident response plans that account for potential breaches originating from your AI stack. Looking ahead, the industry will likely see a greater focus on secure-by-design inference engines. Cloudflare's remediation involved switching to SGLang, a runtime specifically built with better safety guarantees. This move may signal a broader trend toward adopting more robust and auditable serving technologies to prevent such cross-tenant data leaks from happening again.

This incident reveals a new class of vulnerability in multi-tenant AI inference systems. The bug, a "cross-request KV cache exposure," shows how memory optimization techniques in LLMs can break tenant isolation, a critical security boundary for all cloud AI providers and their customers.

For companies using or building on shared AI platforms, this highlights a significant supply chain risk. A vulnerability in a provider's model can lead to direct exposure of proprietary data or customer information, creating serious security, compliance, and reputational damage.