Last changed Oct 27, 2026

Cloudflare's hosted GLM-5.3 model leaked fragments of other customers' requests into 155 responses for two weeks after launch

Cloudflare (Workers AI); Z.ai GLM-5.3 model; SGLang / RadixArk; reporter Gadi Evron (Knostic)

In a coordinated disclosure on Oct 26, Cloudflare said that from GLM-5.3's launch on Workers AI on Aug 27 until Sept 9, 155 responses to prompts longer than 681,280 tokens could contain data from other customers' GLM-5.3 requests made shortly before, drawn from reused KV-cache pages. Two issues combined: the model advertised a 1,048,576-token context while the prefill KV-cache pool held only 681,280 tokens, and an SGLang bug in disaggregated prefill/decode mode passed rejected over-length requests to decode, which attended over stale pages. Gadi Evron of Knostic reported it via HackerOne on Sept 8; Cloudflare set the model private at 14:00 UTC on Sept 9 and restored it at 19:40 UTC after fixing the configuration and engine. Cloudflare says a 'small number of customers' were affected, no other Workers AI model was, and it found 'no evidence of deliberate exploitation'. Fixes shipped in SGLang v0.5.20 to v0.5.22. The post does not say how affected customers were notified.