Cloudflare says a flaw in its GLM-5.3 service exposed fragments of other customers’ requests in 155 responses. The company says it fixed the issue in September and recommends operators using SGLang update to version 0.5.22 or later.
Cloudflare Watch analysis
What happened
In a disclosure published on 26 October, Cloudflare says the issue affected GLM-5.3 on Workers AI from 27 August until the service was taken offline and repaired on 9 September. It says the affected responses were all to prompts longer than 681,280 tokens. Cloudflare reports no evidence of deliberate exploitation.
The company traced the problem to a mismatch between the model’s advertised context length and the memory available for its KV cache, combined with a bug in SGLang’s handling of rejected requests in a disaggregated setup. In some cases, a decode server could use stale cache pages containing data from earlier requests. Cloudflare says it corrected the configuration, patched the inference engine and validated the fixes before restoring the model. Read Cloudflare’s technical disclosure.
Why it matters
This was not simply a model producing an incorrect answer: Cloudflare says some responses included text from other customers’ sessions. The disclosure also shows how a valid-looking response can conceal a failure in the memory and request-handling machinery underneath an AI service.
Cloudflare says GLM-5.3 was the only Workers AI model affected, and that it applied the engine fix and additional hardening across its SGLang deployments. Operators running SGLang elsewhere should check their version and follow Cloudflare’s recommendation to update to 0.5.22 or later.
Our read
The useful lesson is in the seam between advertised capacity and actual serving capacity. Cloudflare says it knew the KV cache pool was smaller than GLM-5.3’s context window, but its tests checked successful HTTP responses and performance rather than validating output coherence. A status code, as it turns out, is not a security audit.
What to watch
- Whether SGLang operators confirm they have updated to version 0.5.22 or later.
- Whether further details emerge about the affected responses or any customer impact.
- How inference providers test memory-pool sizing and rejected requests in disaggregated deployments.
Discussion spark: Should AI inference providers be expected to test for cross-customer data exposure at every model’s advertised maximum context length, even when those requests are unusually large?
Sources and evidence
- Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang (26 October 2026, 22:01 UTC)
not affiliated with or endorsed by Cloudflare