Hallucination or cross-tenant: A large language model on Cloudflare Workers AI answers with another user's context
Hallucination or Cross-Tenant: When an LLM Answers With Another User’s Context
Knostic researcher Gadi Evron found that the @cf/zai-org/glm-5.3 endpoint of Cloudflare Workers AI returns the contents of other users' inference sessions rather than a response to the submitted prompt when a request exceeds about 700,000 tokens. The leaked content included personal names, company names, invoice numbers, euro amounts, payment dates, source code information, and Agent task records. The author used black-box falsification to rule out hallucination and training data reproduction: the unique marker in the request disappeared, latency dropped sharply at about 700,000 tokens, the output had zero overlap with the input, and a shell call returned in one response matched a public repository that was created after the model's training cutoff and had a signed verification commit less than 4 minutes after the affected inference. The issue was reported via HackerOne on September 8, 2026; Cloudflare confirmed and deployed a fix on September 24, publicly disclosed it on October 26, and its blog analyzed in depth the upstream vulnerability in SGLang.
The authors demonstrated an investigation method that uses black-box falsification to rule out alternative explanations such as hallucination and training data reproduction and to confirm cross-tenant leakage, which can be transferred to determining similar inference service issues.