Cloudflare Workers AI
Run machine learning models, powered by serverless GPUs, on Cloudflare's global network.Reference profile
About Cloudflare Workers AI
Workers AI is Cloudflare's serverless inference service. You call open-weight models running on Cloudflare's network from Workers code or a REST API, with no GPUs to rent, and pay for what you use. As of 2026-10-30 the free allocation is 10,000 Neurons a day, and usage beyond that costs $0.011 per 1,000 Neurons.
What problem it solves
When a small team wants an open-weight model in its product, self-hosting means renting GPUs, setting up an inference engine, handling scaling and paying for idle capacity. Workers AI hands that to Cloudflare. You call models through the AI binding inside a Worker, or with an API token over REST, and you're billed only for what you use.
It is part of the same developer platform as Cloudflare's Workers, AI Gateway and Vectorize.
Run machine learning models, powered by serverless GPUs, on Cloudflare's global network.
Core capabilities
- Model catalog: the overview page says 50+ open-source models; on 2026-10-30 the catalog page listed 73. They cover text generation, embeddings, images, speech synthesis and recognition, and translation, including recent large models such as GLM-5.3, Kimi and the DeepSeek V4 family.
- OpenAI-compatible endpoints: /v1/chat/completions and /v1/embeddings work with the OpenAI SDK once you change the base URL. /v1/responses is available only for GPT-OSS models.
- Other features: the docs list function calling (beta), JSON mode, LoRA adapters (beta), prompt caching, an asynchronous Batch API (beta) and Markdown conversion (beta).
- Data commitments: the data-usage page says inputs and outputs of standard inference requests are not retained once the request is done, and that Cloudflare does not train models on customer content processed by Workers AI.
Who uses it
Cloudflare's docs and blog give no user numbers or customer list for Workers AI.
Public incident records show that third-party routers send traffic to it. The exposure ran from 2026-08-27 to 09-09; a Knostic researcher traced it to Cloudflare on 09-07 and reported it to Cloudflare through HackerOne on 09-08. By Knostic's own account, the first stray output appeared while calling a model through OpenRouter.
How it compares
Against self-hosting (for example SGLang or vLLM): running your own gives you full control over versions, configuration and isolation, but you operate the GPUs. Workers AI is pay-per-use with nothing to run, and in exchange Cloudflare decides the models, rate limits and underlying configuration. Cloudflare's own GLM-5.3 deployment runs on SGLang.
Other hosted inference providers price in different units, which makes direct price comparison unreliable.
Who it's for / Not for
Good fit:
- developers already on Cloudflare Workers who want summarization, classification, embeddings or translation inside edge functions;
- individuals and small teams who want to prototype on the free allocation.
Poor fit:
- teams that need to pick model versions, tune inference settings or bring their own model (private custom models require a request form);
- workloads that need high concurrency on frontier models: models that require payment default to 20 requests per minute per model per account.
Getting started
Sign up for a Cloudflare account. In the dashboard, open Workers AI, choose Use REST API, create a Workers AI API token and note your Account ID. You can then call models with curl.
To use it inside your own app, follow the Workers bindings guide: create a Worker with Wrangler and call models through the AI binding.
Pricing & license
A proprietary hosted service. As of 2026-10-30:
- Both Workers Free and Workers Paid include 10,000 free Neurons a day, reset daily at midnight UTC.
- Usage beyond that requires Workers Paid and costs $0.011 per 1,000 Neurons. Workers Paid has a $5 monthly minimum per account.
- The pricing page lists per-model equivalents. GLM-5.3, for example, costs $1.40 per million input tokens and $4.40 per million output tokens.
- Eight models, including GLM-5.3, Kimi K2.6 and the DeepSeek V4 models, require a payment method or prepaid AI Gateway credits.
Risks & limits
A tenant-isolation incident. Cloudflare disclosed that between 2026-08-27 and 09-09, 155 responses from its GLM-5.3 model contained data from other customers' requests, all on prompts longer than 681,280 tokens. Cloudflare was alerted on 09-08 and restored the model on 09-09, and the fixes were merged upstream into SGLang. One cause was that the advertised context length (1,048,576 tokens) was larger than the prefill KV cache pool could hold.
Rate limits. Text generation defaults to 300 requests per minute. Models that require payment get 20 per minute, or 50 with prepaid AI Gateway credits.
An opaque billing unit. Neurons are Cloudflare's own unit, so you have to convert them to token costs using the pricing page.
Our verdict
If you already build on Cloudflare, Workers AI is one of the lowest-friction ways to start using open-weight models, and the free allocation covers prototyping. The GLM-5.3 incident is a reminder that hosted inference is only as well isolated as the open-source engine underneath and the provider's configuration of it. Teams handling sensitive data should read Cloudflare's incident report and fix list as part of choosing a provider.
Sources
Official
- Cloudflare Workers AI overview · Accessed Oct 30, 2026
- Workers AI pricing · Accessed Oct 30, 2026
- Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang · Accessed Oct 30, 2026
- Workers AI: get started with Workers bindings · Accessed Oct 30, 2026
- Workers AI model catalog · Accessed Oct 30, 2026
- Workers AI: OpenAI compatible API endpoints · Accessed Oct 30, 2026
- Workers AI data usage · Accessed Oct 30, 2026
- Workers AI limits · Accessed Oct 30, 2026
- Workers AI: get started with the REST API · Accessed Oct 30, 2026
- Cloudflare Workers pricing · Accessed Oct 30, 2026
Media & third party
- Knostic: Cross-Tenant Data Leak in Cloudflare Workers AI (GLM-5.3) · Accessed Oct 30, 2026
Related products
- SGLang README · Accessed Oct 30, 2026
Updates & reading
In Cloudflare's AI Data Leak, Isolation Fell Between the Cloud and the Open-Source Engine
An SGLang bug report that spelled out the root cause and a patch was closed by a bot for inactivity three days before Cloudflare heard about the leak. Cloudflare assumed the engine would reject prompts that didn't fit; in disaggregated mode it didn't. Small teams that self-host inference or pick a provider face the same gap.
Cloudflare discloses cross-customer data exposure on Workers AI, traced to an SGLang bug
Cloudflare says 155 responses from the GLM-5.3 model on Workers AI between Aug 27 and Sep 9 contained data from other customers' requests, all for prompts over 681,280 tokens. A mismatch between the context window and the KV cache pool triggered a bug in SGLang's disaggregated prefill/decode mode. Cloudflare says it found no evidence of deliberate exploitation; SGLang published a coordinated fix.
2 sources · 1 post on X