Cloudflare says a model bug sent users other customers’ data

A bug in how Cloudflare served the GLM-5.3 AI model sent some customers text from other customers’ requests, the company says. In total, 155 responses were affected, all to prompts longer than 681,280 tokens.

Cloudflare disclosed the problem Monday in a blog post by Kevin Flansburg and Michelle Chen. It says the exposure ran from the model’s Aug. 27 launch on its Workers AI service until Sept. 9. It says no other Workers AI model was affected.

What went wrong

Security researcher Gadi Evron of Knostic reported the issue Sept. 8 through Cloudflare’s HackerOne bug bounty program, the post says. Cloudflare says it took the model offline within 40 minutes of declaring an incident the next day. It restored the model Sept. 9 with a fixed setup and a patched engine.

Cloudflare says two problems overlapped. It offered GLM-5.3 with a 1,048,576-token context window. But the memory pool that holds the model’s working state, called the KV cache, had room for only 681,280 tokens. Cloudflare says it knew about the gap before launch. It expected the engine to return an error for prompts that did not fit.

Instead, a bug in SGLang, the open-source inference engine Cloudflare uses, let those prompts through. The engine swapped the long prompt for a one-token placeholder. The machine writing the answer then read memory pages still holding earlier users’ prompts and partial answers. Cloudflare says those pages are not wiped between requests, a common practice for speed.

Cloudflare says it found no evidence of deliberate exploitation. It says the affected requests matched ordinary long-context use. It says the pool now holds about 2.04 million tokens. It urges other SGLang operators to upgrade to version 0.5.22 or later.

Our read: This is the kind of failure buyers of hosted AI should ask about. Many customers share the same GPUs, and isolation depends on bookkeeping inside the inference engine, not on separate machines. Cloudflare’s own account shows the gap was known before launch and was judged safe because tests returned success codes, not because anyone checked the answers. The post also says the SGLang bug had been reported publicly by another user in July. Cloudflare deserves credit for a detailed public timeline and fixes shared upstream. But “no evidence of deliberate exploitation” is Cloudflare’s finding from its own logs, and it does not tell affected customers what text of theirs reached someone else. The leak needed prompts of more than 681,280 tokens, so few users hit it.

Anthropic reports early drug work

Anthropic says it has worked with six drug developers: BigHat Biosciences, Bristol Myers Squibb, Divergence Labs, Enveda, Generate Biomedicines and The Column Group. It described the results in a research post Tuesday.

Generate says one Claude-proposed design for part of a CAR T-cell therapy was about 70% shorter than the standard and let immune cells make roughly 10 times as many receptors in lab tests. Enveda says Claude cut manufacturing-document review time by 89% in a test on 1,061 pages.

Anthropic says it acquired Mithril Medicine, a one-person muscular dystrophy company founded by Cody Tranbarger. It says a drug could start human trials as soon as late 2028. Anthropic says the work is still mostly preclinical. The results are company- and partner-reported.

ElevenLabs times transcripts with Cue

ElevenLabs introduced Cue, a model that matches each character of a transcript to the moment it is spoken, in a blog post Wednesday. The company says Cue runs behind every transcript from its Scribe speech-to-text models. It says Cue aligns an hour of audio in about half a second. On its own benchmark of real-world recordings, ElevenLabs says Cue’s average timing error was 179 milliseconds, against 283 milliseconds to more than 6,000 for open-source tools it tested.

What’s next

Cloudflare says it is working with SGLang’s maintainers on checks that would stop a request from reading memory it does not own. Anthropic says it plans to expand its clinical trial work with Bristol Myers Squibb in 2027.

Sources: Cloudflare, Anthropic, ElevenLabs