# Cloudflare: GLM 5.3 on Workers AI leaked data across requests

> 155 long-prompt responses contained other customers' data between August 27 and September 9. The cause was a configuration mismatch and a bug in SGLang.

URL: https://claudegpt.si/news/cloudflare-glm-5-3-kv-cache-exposure  
Published: 2026-10-26T22:51:01.000Z  
Author: ClaudeGPT Si Newsroom  
Section: AI Tools  
Topics: Cloudflare, Workers AI, SGLang, GLM, AI security  
Publisher: ClaudeGPT Si

## Key takeaways

- Cloudflare says 155 GLM 5.3 responses on Workers AI contained other customers' data between August 27 and September 9, 2026.
- All affected responses were to prompts longer than 681,280 tokens, the size of the prefill memory pool, while the model's context window was 1,048,576.
- The fix is in SGLang 0.5.20 and 0.5.21; Cloudflare advises operators to use 0.5.22 or later.

Cloudflare disclosed on October 26 that its Workers AI service returned data from other customers' requests to some users of the GLM 5.3 model. According to [Cloudflare's post-incident write-up](https://blog.cloudflare.com/kv-cache-exposure-remediation/), 155 responses were affected between August 27 and September 9, 2026, and all of them were to prompts longer than 681,280 tokens.

It matters because the cause is a bug in SGLang, an open-source engine many teams use to serve language models. Anyone running it in a certain mode could have the same problem.

## What happened

A security researcher, Gadi Evron of Knostic, reported the problem through Cloudflare's HackerOne bug bounty program on September 8. Cloudflare set the model to private at 14:00 UTC on September 9 and restored public access at 19:40 UTC the same day, after validating a fix.

Cloudflare says no other Workers AI model was affected and that it found no evidence of deliberate exploitation. The affected requests looked like ordinary long-context use in timing and volume.

## Why it happened

Two things overlapped, according to Cloudflare:

- **A configuration mismatch.** GLM 5.3 was deployed with a context window of 1,048,576 tokens, but the memory pool used for the prefill step held only 681,280 tokens. Prefill is the step where the model reads the prompt, and the KV cache is the memory it keeps of what it has read.
- **An SGLang bug.** In its disaggregated mode, which splits prefill and decoding across machines, SGLang replaced over-length prompts with a one-token placeholder instead of rejecting them. The decoding step then generated text from stale cache pages left by earlier requests, and returned a normal HTTP 200 response instead of an error. Cloudflare says SGLang had received a report of this bug on July 6, 2026.

## The fix

Cloudflare resized the prefill pool to about 2.04 million tokens, roughly twice the context length. It also changed the engine so over-length requests are rejected before any memory is transferred. The fix went upstream in SGLang pull requests 36988 and 38935, which shipped in versions 0.5.20 and 0.5.21.

## What operators should check

The post lists no required action for Workers AI customers. Its advice is for people who run SGLang in disaggregated mode: check that the KV pool is at least as large as the context length, upgrade to SGLang 0.5.22 or later, and turn on corruption detection where it is supported.

## Sources

- [Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang](https://blog.cloudflare.com/kv-cache-exposure-remediation/), Cloudflare