Were other Workers AI models affected by the GLM-5.3 KV cache leak?

Cloudflare says no. The disclosure states that only the GLM-5.3 model (@cf/zai-org/glm-5.3) on Workers AI was affected, because only that deployment combined a 1,048,576-token context window with a prefill KV cache pool of 681,280 tokens. Cloudflare has since added checks of KV pool size against context length to its production SGLang deployments.

How was the Cloudflare GLM-5.3 leak found and how fast was it fixed?

Security researcher Gadi Evron of Knostic reported the GLM-5.3 issue through Cloudflare's HackerOne program on September 8, 2026. Cloudflare set the model to private on September 9, applied a configuration fix and an SGLang engine patch, tested both against the researcher's reproduction script and its own canary tests, and restored the model the same day.

Do I need to change my SGLang setup after the Cloudflare KV cache disclosure?

Cloudflare recommends that operators running SGLang with disaggregated prefill and decode check that the KV cache pool is at least as large as the context length they advertise, and upgrade to SGLang v0.5.22 or later. Cloudflare's patch, which returns rejected requests with their error before any KV transfer, first landed in SGLang v0.5.20.

Did attackers exploit the Workers AI GLM-5.3 cache bug?

Cloudflare says the 155 affected requests look like ordinary long-context use and that it found no evidence of deliberate exploitation. The disclosure does not give an exact number of affected customers, describing them only as a small number, and it does not list specific actions Workers AI customers need to take.

Cloudflare · 2026-10-26 · major

Cloudflare GLM-5.3 leak — KV cache bug sent 155 replies to the wrong customers

Cloudflare disclosed that GLM-5.3 on Workers AI sent 155 responses containing data from other customers' requests between August 27 and September 9, 2026, caused by a KV cache pool misconfiguration plus an SGLang bug.

Cloudflare blog header for the GLM-5.3 Workers AI KV cache exposure disclosure

A long-prompt edge case on Cloudflare's GLM-5.3 endpoint let some customers see pieces of other customers' requests.

Quick facts

Affected model	GLM-5.3 on Workers AI
Exposure window	Aug 27 – Sep 9, 2026
Affected responses	155, all to prompts over 681,280 tokens
Reported by	Gadi Evron (Knostic), via HackerOne
Upstream fix	SGLang v0.5.20 (follow-ups in v0.5.21, v0.5.22)

What is it?

Cloudflare published a disclosure of a tenant isolation failure in the GLM-5.3 model (@cf/zai-org/glm-5.3) on Workers AI. From August 27 to September 9, 2026, 155 responses to a small number of customers contained data from other customers' requests made to the same model shortly before. All 155 came from prompts longer than 681,280 tokens; Cloudflare says no other Workers AI model was affected and it found no sign of deliberate exploitation.

How does it work?

The leak needed two faults at once. The GLM-5.3 deployment advertised a 1,048,576-token context window, but its prefill KV cache pool held only 681,280 tokens. When a prompt did not fit, SGLang marked it rejected and swapped in a one-token placeholder, yet still transferred KV cache to the decode node instead of returning an error, so decoding attended over stale cache pages that still held other requests' data.

Why does it matter?

Disaggregated prefill/decode serving is now common for long-context models, and this incident shows that a shared KV cache can leak data across tenants when an overflow is not handled as a hard error. Cloudflare's fix landed upstream in SGLang v0.5.20, so anyone running SGLang in that mode should check their KV pool size against the advertised context length and upgrade.

Who is it for?

teams running or buying hosted LLM inference

Frequently asked questions

Were other Workers AI models affected by the GLM-5.3 KV cache leak?: Cloudflare says no. The disclosure states that only the GLM-5.3 model (@cf/zai-org/glm-5.3) on Workers AI was affected, because only that deployment combined a 1,048,576-token context window with a prefill KV cache pool of 681,280 tokens. Cloudflare has since added checks of KV pool size against context length to its production SGLang deployments.
How was the Cloudflare GLM-5.3 leak found and how fast was it fixed?: Security researcher Gadi Evron of Knostic reported the GLM-5.3 issue through Cloudflare's HackerOne program on September 8, 2026. Cloudflare set the model to private on September 9, applied a configuration fix and an SGLang engine patch, tested both against the researcher's reproduction script and its own canary tests, and restored the model the same day.
Do I need to change my SGLang setup after the Cloudflare KV cache disclosure?: Cloudflare recommends that operators running SGLang with disaggregated prefill and decode check that the KV cache pool is at least as large as the context length they advertise, and upgrade to SGLang v0.5.22 or later. Cloudflare's patch, which returns rejected requests with their error before any KV transfer, first landed in SGLang v0.5.20.
Did attackers exploit the Workers AI GLM-5.3 cache bug?: Cloudflare says the 155 affected requests look like ordinary long-context use and that it found no evidence of deliberate exploitation. The disclosure does not give an exact number of affected customers, describing them only as a small number, and it does not list specific actions Workers AI customers need to take.

Try it

Operators: upgrade SGLang to v0.5.22 or later and keep the KV pool at least as large as the context length