Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
A configuration mismatch and an inference-engine rejection bug exposed fragments of other customers’ requests in a limited set of long-context responses.
TL;DR
- Cloudflare said 155 GLM-5.3 Workers AI responses between August 27 and September 9, 2026 contained data from other customers’ requests.
- The company attributed the exposure to a prefill KV cache pool smaller than the model’s configured context window and a SGLang rejection-path bug.
- Cloudflare enlarged the pool and patched the request path before restoring the model; SGLang’s coordinated post describes related upstream fixes.
Cloudflare disclosed that 155 responses from its GLM-5.3 model on Workers AI contained data from other customers’ requests between August 27 and September 9, 2026. The company said every identified response followed a prompt longer than 681,280 tokens and that it found no evidence of deliberate exploitation. [1]
The deployment advertised a 1,048,576-token context window, while the prefill GPU pool used to hold the model’s key-value cache had capacity for fewer tokens. Cloudflare said a request that exceeded the pool could enter a disaggregated prefill/decode path where SGLang mishandled the rejection and allowed stale cache pages to be read. [1] [2]
Cloudflare said it corrected the pool configuration to about 2.04 million tokens and changed the rejection path so invalid requests are retired before cache allocation or transfer. It reported testing the changes and restoring the model on September 9. [1]
SGLang’s coordinated account describes the admission fix and other request-isolation work, including safeguards around aborts and cache transfers. The posts document this deployment and the fixes discussed with maintainers; they do not establish that other model-serving systems experienced the same exposure. [2]
Why it matters
The incident shows how advertised context limits and physical cache capacity can diverge in multi-tenant inference, while an error path turns that mismatch into a data-isolation failure. It also puts operational safeguards in the AI infrastructure story alongside model performance and compute scale.
Editor's note
Uses Cloudflare’s incident account and the SGLang maintainers’ coordinated technical account; the reported impact is limited to 155 responses in the stated period.