October 29, 2026 | Cybersecurity, Artificial Intelligence
Imagine a hotel with a thousand rooms.
Each guest receives their own private room. After they check out, the maid changes the linens, cleans up the belongings, and prepares the space for the next visitor.
But one day, a glitch occurs.
A new guest opens the closet, and inside lie the documents of the previous occupant. Someone else's correspondence, work notes, and potentially confidential information.
Nobody picked the lock. Nobody guessed the password.
The system simply decided the room was ready, even though it hadn't been cleaned.
On October 26, 2026, Cloudflare shared a strikingly similar story. Only instead of a hotel, it was cloud artificial intelligence, and instead of a closet, it was GPU memory.
The Neural Network That Remembered Someone Else
From August 27 to September 9, the GLM-5.3 model was active on the Workers AI cloud platform.
It was used for text processing, programming, and other tasks.
Everything appeared normal until security researcher Gadi Evron discovered strange behavior.
Occasionally, the neural network responded to a user prompt with fragments of information belonging to an entirely different client.
Cloudflare launched an investigation and confirmed the issue.
In total, the company identified 155 affected responses.
Important: this refers to responses, not necessarily 155 different users. The company found no evidence of malicious exploitation of the bug by attackers.
How One Person's Memory Ended Up With Another
To enable fast operation, neural networks utilize a specialized mechanism known as the KV cache.
Simply put, this is a working memory that stores intermediate results of text processing.
This prevents the model from having to re-compute all previous information from scratch every time it generates the next word.
To speed things up, servers may reuse sections of video memory after requests are completed.
By itself, this is standard procedure.
The problem arose due to a combination of two errors.
First: the model was configured to handle approximately one million tokens, but the allocated memory was only sufficient for 681,000.
Second: the SGLang software engine improperly handled requests that did not fit into memory.
Instead of issuing a proper failure, the system kept running.
And when generating a response, it could draw upon old data left behind in memory by other users.
That is how someone else's information wound up in a new response.
The Greatest Danger: The System Reported No Error
There is a detail in this incident that developers should take special note of.
The server returned a standard successful HTTP 200 response.
To a monitoring system, this looked like completely normal operation.
Request accepted. Response generated. No errors.
Yet inside that response could be the data of another client.
Consequently, checking solely for API availability and successful HTTP status codes is not enough.
A system can technically function properly while simultaneously violating confidentiality.
Why This Matters for Personal AIs
Imagine a future where everyone has their own personal AI assistant.
One person discusses family matters. Another uploads a commercial contract. A third analyzes source code containing private keys.
Externally, everyone has their own workspace and unique chat history.
However, if all assistants share a common inference server, separating user accounts still does not guarantee proper isolation of the model's working memory.
The Cloudflare incident demonstrated that breaches can occur below the application layer.
Not in the database, not in the authorization system, and not even in the chatbot's own logic.
Rather, deep inside the GPU request processing mechanism.
This does not mean that all cloud neural networks expose foreign data. The identified issue affected a specific model and configuration.
Yet engineers now have another confirmed scenario that must be accounted for.
What the Developers Did
Cloudflare disabled the problematic model, fixed the memory configuration, and implemented patches in SGLang.
Now, rejected requests should no longer continue processing as if they had successfully passed checks.
Additionally, the company strengthened validations for data transmission and reuse across compute nodes.
Developers utilizing distributed SGLang are advised to update to version 0.5.22 or a later patched release.
Yet the main takeaway extends far beyond a single software product.
The New Frontier of Digital Security
Previously, our primary fears revolved around attackers stealing a password, breaching a database, or intercepting network traffic.
Now, an additional question arises.
What if one person's data ends up in someone else's hands not because of a hack, but due to an artificial intelligence memory management error?
In a multi-tenant AI infrastructure, isolation must exist at every level: from accounts and APIs to computing processes and accelerator memory.
Especially as neural networks gain access to documents, private messages, repositories, and enterprise systems.
Conclusion
Cloudflare's incident does not feature a confirmed large-scale hacker attack.
Instead, it offers something equally instructive: a real engineering flaw that breached the boundary between users.
Cases like this help us realize just how complex artificial intelligence security is becoming.
We have learned to protect connections with encryption. We have learned to segregate database access.
Now we must secure the memory of the computing systems themselves with equal reliability.
Because a true personal AI must not only remember its owner—it must guarantee it never recalls a stranger's data.
GLASS BRIDGE
Primary Sources
Cloudflare, October 26, 2026. Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang.
https://blog.cloudflare.com/kv-cache-exposure-remediation/
SGLang, open-source inference engine project, fixes, and development history.