Jul 6, 2026

Updated

• Live✓Patched

  Cloudflare Workers AI's GLM-5.3 returned other customers' data in 155 responses after an SGLang KV cache bug; SGLang operators should update to v0.5.22

  Between Aug 27 and Sep 9 2026, Cloudflare's GLM-5.3 model on Workers AI (@cf/zai-org/glm-5.3) sometimes answered very long prompts with data from other customers' recent requests to the same model, Cloudflare disclosed on Oct 26. 155 responses were affected, all to prompts longer than 681,280 tokens. Two issues combined: Cloudflare launched the model with a 1,048,576-token context window but a prefill KV cache pool that held only 681,280 tokens, and SGLang, the open-source inference engine it uses, mishandled over-length requests in disaggregated prefill/decode mode. Instead of returning an error, it swapped the prompt for a one-token placeholder, transferred one KV page, and let the decode node attend over stale cache pages still holding earlier users' prompts and partial generations, returning HTTP 200. Researcher Gadi Evron of Knostic reported it via HackerOne on Sep 8; Cloudflare took the model offline on Sep 9, fixed its configuration and engine, and restored it the same day. It found no evidence of deliberate exploitation and says no other Workers AI model was affected, so Cloudflare customers have nothing to do. Anyone running SGLang in disaggregated prefill/decode mode should update to v0.5.22 or later (or backport #36988 and #38935) and check that each node's KV pool is at least as large as the context length.

  SGLang inference engine (disaggregated prefill/decode mode); Cloudflare Workers AI GLM-5.3 model·Since Aug 27, 2026·updated Oct 30, 2026, 15:15 UTC