Workers AI Bug Leaked 155 GLM-5.3 Responses

Cloudflare disclosed on Oct. 26 that its Workers AI service returned text from other users' sessions in 155 responses from the GLM-5.3 model between Aug. 27 and Sept. 9, 2026. The company traced the leak to a context-window misconfiguration combined with a bug in SGLang, the open-source inference engine it uses to serve the model.

Key takeaways

• Only prompts longer than 681,280 tokens sent to @cf/zai-org/glm-5.3 were affected; Cloudflare says no other Workers AI model was involved.
• A security researcher reported the flaw through HackerOne on Sept. 8, and Cloudflare took the model private the next day before restoring it with a fix.
• Cloudflare recommends that anyone running SGLang upgrade to v0.5.22 or later.

What leaked in the GLM-5.3 KV cache bug

According to Cloudflare's incident write-up, by engineers Kevin Flansburg and Michelle Chen, very long prompts could come back with fragments of other users' recent prompts and partial generations. The post says only "a small number of customers" received affected responses and gives no account count.

"We found no evidence of deliberate exploitation," Cloudflare wrote, adding that the affected requests matched the timing and volume of ordinary long-context use.

How a context-window mismatch exposed other sessions

Cloudflare advertised GLM-5.3 with a 1,048,576-token context window, but the prefill KV cache pool held only 681,280 tokens. SGLang sizes that pool at startup from leftover GPU memory, separately from the configured context length. "Nothing forces the two to agree, and it is our job to check that they do," the company wrote, conceding it knew of the mismatch before launch.

The second half was an SGLang bug in disaggregated prefill/decode mode, where separate nodes handle prompt processing and token generation. Over-length requests were marked rejected but still ran with a one-token placeholder, because admission queues checked whether a request had finished rather than whether it had been rejected. The decode node then read stale KV cache pages left by earlier requests, since pages are not zeroed between uses, and returned HTTP 200 instead of an error.

Cloudflare also named a testing gap: pre-launch checks validated HTTP status codes and streaming behavior, not whether the output was correct.

Timeline of the Workers AI incident

Gadi Evron of security firm Knostic filed the report at 23:11 UTC on Sept. 8. Cloudflare declared an incident at 13:22 UTC on Sept. 9 after reproducing the leak with two independent accounts, set the model to private at 14:00, and returned it to public access at 19:40 with a corrected configuration and an engine patch.

Context: a risk that comes with shared inference

KV caches store intermediate attention data so models don't recompute long prompts, and providers pool that memory across many customers to cut costs. Unite.AI, citing SGLang's coordinated disclosure, reported that only disaggregated serving was affected, that another user had filed a related bug report in July, and that the fix was not backported to older release branches. Cloudflare has been pushing hard to make Workers AI a home for agent workloads, as part of its plan to rebuild the web for agents, which raises the stakes for tenant isolation.

What's next for SGLang and Cloudflare

Cloudflare raised the prefill pool to about 2.04 million tokens, roughly double the context length, and added a deployment check comparing pool size to context length. Upstream SGLang now retires rejected requests at admission before any KV transfer; the fixes shipped in v0.5.21 on Oct. 2 and v0.5.22 on Oct. 19.

Longer term, Cloudflare is working with SGLang on tagging each KV page and checking tags before decode reads. A prototype cost under 1% in throughput and tail latency but was disabled in August over reliability issues. The company also plans to formally verify its RDMA-based KV transfer protocol and to zero KV pages on release.

FAQ

Was my Workers AI data exposed?

Only if you sent GLM-5.3 a prompt longer than 681,280 tokens between Aug. 27 and Sept. 9, 2026, or if your earlier prompts sat in cache pages read by such a request. Cloudflare says no other model was affected.

Do self-hosted SGLang users need to act?

Yes, if they use disaggregated prefill/decode. Cloudflare recommends upgrading to SGLang v0.5.22 or later and making sure the KV pool is at least as large as the configured context length.

Who found the bug?

Gadi Evron of Knostic reported it through Cloudflare's HackerOne bug bounty program on Sept. 8, 2026.

References

• Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang — Cloudflare Blog (Oct. 26, 2026)
• Cloudflare Says GLM-5.3 Bug Leaked 155 Responses Across Tenant Sessions — Unite.AI (Oct. 26, 2026)