Cloudflare Says KV Cache Bug Leaked 155 GLM-5.3 Responses

Between August 27 and September 9, 155 responses returned by GLM-5.3 running on Cloudflare's Workers AI contained data from earlier users' prompts. Cloudflare's own incident writeup traces the exposure to a tenant isolation failure in the serving stack, not the model itself.

The report came in on September 8 from Gadi Evron of Knostic, filed via HackerOne. The next day the team reproduced the leak in 25 minutes and took the model private at 14:00 UTC.

Two faults overlapped. The model was deployed with "a 1,048,576-token context window, but the KV cache pool on our prefill GPUs only had room for 681,280 tokens." That mismatch alone would be a sizing error. The second fault, in the SGLang engine Cloudflare runs in disaggregated mode, turned it into a leak: when a prompt overflowed the pool, prefill swapped it for a one-token placeholder, but the decode node "assumed that prefill overwrote the KV cache from previous requests with the full prompt for this request, when in fact it left the majority of the previous state intact." Decode then read stale pages still holding earlier users' state.

"155 responses were affected, all to prompts longer than 681,280 tokens," the post states. Cloudflare says "Every other disaggregated deployment on Workers AI has KV pools larger than its context length on both prefill and decode, so no request could reach the rejection path."

The fix shipped the same day. The prefill pool was expanded to roughly 2.04 million tokens, and an SGLang patch now retires over-length requests at the admission queue before any KV allocation happens. The upstream engine's v0.5.22 release, dated October 19, bundles those changes with KV transfer checksums and deferred release by default. This is the third cybersecurity story we have tracked this week where the leak surface is the inference plumbing rather than the model.