Cloudflare Workers AI: GLM-5.3 responses leaked other customers’ prompt data via KV cache

What happened

• Between 27 Aug and 9 Sep 2026, 155 responses from @cf/zai-org/glm-5.3 contained data from other customers’ recent requests to the same model, all for prompts longer than 681,280 tokens. Cloudflare found no evidence of deliberate exploitation.
• Root cause: prefill KV cache pool (681,280 tokens) smaller than the advertised 1,048,576 context, plus an SGLang disaggregated prefill/decode bug that replaced over-length requests with a one-token placeholder instead of aborting, so decode attended over stale KV pages.
• Attribution: not an attack. Reported by Gadi Evron (Knostic) via HackerOne on 8 Sep.
• Response: model pulled, pool resized, SGLang patched (upstream PRs #36988, #38935); Cloudflare recommends SGLang v0.5.22 or later.

Sources

• https://blog.cloudflare.com/kv-cache-exposure-remediation/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.