LiveOverflow demonstrates full exploit chain against Cloudflare Workers AI
Cloudflare confirmed that 155 responses from its GLM-5.3 Workers AI model exposed other customers' data between August 27 and September 9, 2026, caused by an SGLang KV cache bug plus a misconfiguration. Researcher LiveOverflow published a complete working exploit chain against the service: data leak with about 225 requests in one minute and victim compromise with another 400 in two minutes. The service is remediated; teams running disaggregated SGLang should update to v0.5.22 or later.
What happened
Cloudflare confirmed that 155 responses from its Workers AI service delivered other customers' data between August 27 and September 9, 2026. Researcher LiveOverflow showed a complete attack chain: the leak lands in about one minute and victim compromise in two. The service was remediated on September 9, 2026.
Why it matters
Content customers sent to the AI service may have reached third parties. Cloudflare says only the GLM-5.3 model was affected and it found no evidence of deliberate exploitation. Similar flaws could affect other AI services, extending the risk beyond Cloudflare.
What to do
Check with Cloudflare whether the company's long prompts were affected in that window. If the team runs disaggregated SGLang, update to v0.5.22 or later.
For the technical team
- Affected
- Cloudflare Workers AI (modelo GLM-5.3) · Cloudflare Workers AI model GLM-5.3: prompts longer than 681,280 tokens processed between August 27 and September 9, 2026; 155 responses contained other customers' data. Cloudflare says no other hosted model was affected. DailyDarkWeb note: disaggregated SGLang before v0.5.22.
- Exploitation
- Cloudflare says it found no evidence of deliberate exploitation. LiveOverflow reported a complete working chain against Cloudflare: about 225 requests (1 minute) for the leak and another about 400 (2 minutes) to compromise the victim.
- Fix
- Cloudflare service remediated: reported via HackerOne on September 8, 2026, fixed September 9, and disclosed October 26 together with the SGLang maintainers. Disaggregated SGLang: update to v0.5.22 or later (DailyDarkWeb note).
- Vector
- KV cache pool smaller than the GLM-5.3 model's context window, combined with an SGLang rejection-handling bug; responses read stale KV-cache pages left by earlier requests. It affected prompts longer than 681,280 tokens. LiveOverflow's chain runs against Cloudflare's hosted service.
- More details
- Cloudflare has not said how many distinct customers were affected or what categories of data were exposed; 155 is the response count (DailyDarkWeb analyst note). TheHackersNews reports related flaws could affect other AI services. The sources do not detail what the victim compromise controls.
Timeline
LiveOverflow publishes a full exploit chain against Cloudflare: leak obtained with roughly 225 requests and compromise with another 400, within minutes.
Patch confirmed: an SGLang KV cache bug plus misconfiguration exposed other customers' data in 155 responses, and similar flaws could affect other AI services.
Incident opened.
Sources 3 sources
- @DailyDarkWeb @DailyDarkWeb
- @TheHackersNews @TheHackersNews
- @LiveOverflow @LiveOverflow
