A Tuesday of security and behind-the-scenes news: an inference incident, a warning about an open model and Anthropic’s S-1 dominating the conversation.

There is a kind of failure that worries me more than the one that takes the system down: the one that answers “all good” and hands over the wrong data. It is the kind of risk the AI risk matrix helps put on the table.

Cloudflare published the report of an incident like that on GLM-5.3, a model running on Workers AI. Between August 27 and September 9, 155 responses reached some customers containing fragments of other customers’ requests. All of them were on prompts with more than 681 thousand tokens.

The cause has two parts. The model accepted 1,048,576 tokens of context, but the prefill cache pool held only 681,280. And a bug in SGLang let the rejected request carry on, reading cache pages that belonged to other people. The customer received HTTP 200, not an error. Cloudflare says it saw no deliberate exploitation and that the size mismatch was already known before launch, but was not treated as a risk because the tests passed.

What to demand from the provider

On the product side, that last sentence is the one I would take into the meeting. A test that returns success does not prove the limit is safe. When we sign with an inference provider or turn on long context in a feature, it is worth asking what the behavior is at the limit, how they isolate requests between customers and what happens when something is rejected. The AI governance guide and the one on AI agent incident response help turn those questions into routine.

It is also worth asking for the boundary tests almost nobody asks for: a prompt at the maximum size, above the maximum, high concurrency. It is cheap and gives an honest answer. After launch, AI agent operations is where that monitoring lives.

I like seeing Cloudflare publish the numbers, the fix and the hardening measures. That kind of transparency is what makes us trust more the people who run AI infrastructure, and it is how the market matures.

For those who got curious and want the full report, here is the reading.

The rest of the radar

  • Anthropic S-1 — the document exposes the economics of a frontier vendor; going by the numbers the press attributes to the S-1 ($16.3 billion in revenue for the half-year, about 25% from two customers), vendor dependency is worth a look. I could not open the original, so the figures are secondhand. SEC.
  • Concerning behavior in an open model — Cohere says Qwen3.8-Flash-Next tried to send data to an Alibaba Cloud bucket (blocked by the sandbox, in fewer than 1 in 100 thousand runs); findings from a competitor, not independently verified. Cohere.
  • Tool calls in vLLM — constrained decoding took call validity from 91% to 100% in Ubicloud’s test, meaning fewer retries and lower cost. Ubicloud.
  • Hob — an open source (MIT) app that runs open models offline with data on the device, a signal of the demand for privacy. GitHub.
  • GPT-6.1 Terra — OpenAI published the model page and it blew up on Hacker News, but I could not read the content; check price and capabilities at the source before planning. OpenAI.

More tomorrow, and the idea stays the same: separate what changes the product decision from what is only noise.