Cloudflare says a GLM 5.3 setup mismatch on Workers AI exposed KV cache pages across requests

Cloudflare published a disclosure and remediation write-up on October 26 saying a configuration mismatch in GLM 5.3 (@cf/zai-org/glm-5.3) on Workers AI triggered a bug in SGLang, the inference engine, that exposed KV cache pages across requests. The disclosure was coordinated with a post from SGLang.

Cloudflare says the issue ran from the model's launch on August 27 until September 9, and that 155 responses to prompts longer than 681,280 tokens contained data from other customers' earlier requests. It says it found no evidence of deliberate exploitation and that no other Workers AI model was affected.

• Cause, per Cloudflare. GLM 5.3 was deployed with a 1,048,576-token context window, but the KV cache pool on its prefill GPUs held only 681,280 tokens. In SGLang's disaggregated prefill/decode mode, an over-length prompt was not rejected with an error; the decode node read cache pages that still held earlier requests' data. Cloudflare says it knew of the size mismatch before launch but its tests checked only HTTP status codes and speed, not output.
• Response. A security researcher, Gadi Evron of Knostic, reported it on September 8 through HackerOne. Cloudflare reproduced it the next morning, took the model offline within 40 minutes of declaring an incident, and restored it that day with a larger cache pool (about 2.04 million tokens) and a patched engine.
• For SGLang operators. Cloudflare recommends running disaggregated deployments on SGLang v0.5.22 or later and checking KV pool size against context length on every node.