UpTrajectory Review

Cloudflare published a postmortem on a bug in Workers AI, its platform for running large language models on Cloudflare's edge network. The flaw let one customer's request read pieces of another customer's KV cache — the stored intermediate state that makes model responses fast and cheap. Cloudflare says it found the problem during an internal security review, fixed it, and found no evidence of exploitation. The company has notified affected customers. The Hacker News thread that carried the link shows the usual split: engineers praising the disclosure and skeptics asking how long the window was open.

If you run a small business and have dipped a toe into AI features — a support bot, a summarizer, a drafting tool — this is the kind of story that should sharpen your vendor questions. You almost certainly did not build on Workers AI directly, but you may use a product that does. The practical point is not that Cloudflare failed; it is that a caching layer, the invisible machinery that makes AI affordable, leaked data across tenant boundaries. Any AI vendor you rely on has the same machinery. Ask yours how it isolates cache, who can see it, and what its incident-notification timeline looks like.

What is genuinely new here is the attack surface, not the bug class. Cross-tenant data leaks are old news in multi-tenant software. What is under-reported is that KV caches are becoming a standard part of every inference stack, and they sit in a awkward spot: too transient for classic database auditing, too sensitive to treat as disposable. We are skeptical of any vendor, Cloudflare included, that treats cache isolation as a solved problem. The honest posture is that these systems are young, the tooling to inspect them is thin, and postmortems like this one are the evidence.

The second-order effects cut in two directions. For operators, the near-term cost is diligence: you now owe your customers a coherent answer about the AI components in your stack, and 'our vendor handles security' will not survive a serious procurement questionnaire. For the industry, each disclosed bug raises the bar for everyone else. A competitor that stays silent about its own cache architecture will look worse, not better, as these postmortems accumulate. Expect more disclosure, and expect insurers and enterprise buyers to start asking for cache-isolation specifics in contracts.

Watch two things. First, whether Cloudflare or any peer publishes technical detail on how cache isolation is enforced and verified — that is the difference between a postmortem and a marketing page. Second, whether your own vendors can answer a one-line question in writing: can one customer's data appear in another customer's inference response? If you run anything on Workers AI, read the full postmortem and check whether your account was in the notified set. If you build on someone else's model API, put cache isolation on your security review checklist now, before your next renewal.

Takeaway: Ask every AI vendor in your stack, in writing, how it isolates KV cache between customers — and read Cloudflare's full postmortem for the questions to ask.