Cloudflare and the loss of KV cache isolation: the GLM-5.3 case

On 26 October 2026, Cloudflare published the details of a security incident in which, between 27 August and 9 September 2026, the GLM-5.3 model on Workers AI returned to some customers responses containing data from other users' requests. The incident affected 155 responses, all generated from prompts longer than 681,280 tokens. According to Cloudflare, no other Workers AI model was affected. The leak had two causes. The first was a configuration mismatch between the model's context window (1,048,576 tokens) and the capacity of the KV cache pool on the prefill GPUs (681,280 tokens). Cloudflare knew about it before launch but did not expect it to cause problems. The second was a bug in the open source inference engine SGLang.

According to the company's reconstruction, when a prompt exceeded the KV cache limit, SGLang in disaggregated mode marked the request as rejected and swapped it for a placeholder but did not stop the flow. The admission queues checked only whether execution had finished, not whether the request had been rejected. That let the decode node read memory pages still holding data from earlier prompts and send the client an HTTP 200 instead of an error. A similar problem had already been reported on the SGLang repository on 6 July 2026, in issue #30233. Unite.AI, drawing on the official report, adds that Cloudflare's pre-launch checks covered HTTP response codes and long-context performance but not the correctness of the model's final output.

Security researcher Gadi Evron of Knostic reported the incident on 8 September 2026 via HackerOne. On 9 September (UTC), Cloudflare declared the incident at 13:22 after reproducing it from two separate accounts. The model was made private at 14:00, and the cause was identified at 14:35. The model went public again at 19:40, once the prefill KV cache pool had been raised to about 2.04 million tokens. That is roughly double the context window, as in the GLM 5.2 configuration. The SGLang fix, which now discards rejected requests with their original error before any KV transfer, was submitted upstream (#38704) and ships from SGLang v0.5.20 onward. Publication of the report was coordinated with the SGLang maintainers (RadixArk). Cloudflare advises SGLang users to upgrade to v0.5.22 or later and to check KV pool size against context length on every node. Several questions remain open, however. In its report Cloudflare says it found no evidence of deliberate exploitation ("We found no evidence of deliberate exploitation"), but that is an internal assessment no third party has verified. Cloudflare says only that a small number of customers were affected, without giving a figure. It does not specify exactly what kind of data the 155 responses exposed, or say whether and how affected customers were notified. Evron's research report has not been published yet.

Splitting prefill and decode across separate infrastructure makes long contexts affordable, but it moves the security boundary onto the integrity of shared GPU memory. When resource optimisation and performance tests come before checks on output correctness, a single uncaught error state can turn efficiency into an accidental loss of isolation. — Olya