A cross-tenant data leak in Cloudflare Workers AI exposed sensitive inference session data across organizational boundaries, including customer names, invoice details, and source code. The root cause was an upstream bug in SGLang, the inference serving framework powering the GLM-5.3 model deployment. Cloudflare has patched the issue, but the incident raises urgent questions for any organization running shared AI inference infrastructure.
What happened
Adversa AI's November 2026 AI security roundup documented cross-tenant inference session bleed affecting Cloudflare Workers AI's GLM-5.3 model deployment. Session data from one tenant was visible to other tenants sharing the same inference pool. The leaked content included customer names, invoice details, and source code snippets that belonged to entirely different organizations.
The root cause was traced to SGLang, the open-source large language model serving framework. SGLang's session isolation mechanisms failed under certain concurrent load conditions, allowing inference context to bleed across organizational boundaries. Cloudflare identified and patched the vulnerability after disclosure. No persistent storage was affected; the leak was limited to in-flight inference context.
Why this matters for enterprise AI infrastructure
Shared inference infrastructure is the dominant model for cloud AI deployment. When you send a prompt to any cloud AI service, your request lands in a shared compute pool alongside requests from other organizations. Isolation between those sessions is enforced at the software level, through the inference engine and the platform layer above it.
This incident demonstrates that software-level isolation can fail. The implications are significant: sensitive data processed through shared AI assistants, including internal code, customer records, and financial documents, is not automatically protected by the cloud provider's organizational boundary. If the inference engine has a session isolation bug, that data can reach any other tenant running concurrent requests.
The SGLang angle
SGLang is widely used in both cloud provider deployments and self-hosted inference stacks. If you operate a self-hosted inference server that uses SGLang for model handling, check whether your version is affected. The Cloudflare disclosure did not include a CVE assignment at time of writing.
Shared inference at scale introduces a class of isolation failure not present in dedicated deployments. When a single session management bug can expose data from every concurrent tenant, the blast radius scales with the number of organizations using the platform simultaneously.
What to do now
- Audit your AI inference logs for anomalous cross-tenant content. Look for data that does not match your own sessions, particularly names, account numbers, or code that appears unfamiliar.
- Review what data you send to shared inference endpoints. If you are processing personally identifiable information, financial records, or proprietary source code, evaluate whether a dedicated inference deployment or on-premises model better fits your data classification requirements.
- Monitor SGLang releases if you run self-hosted inference. The upstream bug that caused this incident may affect other deployments built on SGLang. Upgrade to the patched version as soon as it is available from your distribution.
- Apply the principle of least privilege to AI integrations. When an AI assistant needs access to your systems, limit its scope to the minimum data required for the task. This limits blast radius if inference context leaks.
Written by Gigia Tsiklauri, Security Architect and AI Security specialist at Infosec.ge.