Cloudflare GLM-5.3 cache bug exposed 155 customer responses
Cloudflare deployed GLM-5.3 with a cache smaller than its context window and trusted an error path the engine never had.
TL;DR
Cloudflare disclosed a cross-request KV cache exposure in Workers AI's GLM-5.3 model that returned another customer's data in 155 responses between August 27 and September 9, with no other model affected. Every affected response followed a prompt longer than 681,280 tokens. Cloudflare knew before launch that its SGLang cache pool held only 681,280 tokens against a 1,048,576-token context window and expected the engine to reject over-length prompts. That rejection path never fired, leaving stale cache pages intact.
Cloudflare's disclosure reads like a textbook on why tenant isolation fails at the boundary condition rather than in the common case. The GLM-5.3 Workers AI model returned data from other customers' sessions in 155 responses between August 27 and September 9. Every one of those responses followed a prompt longer than 681,280 tokens. Nobody exploited the bug, Cloudflare says; the request volume matches ordinary long-context use.
The root cause was two overlapping faults. The first Cloudflare knew about before launch: the model advertised a 1,048,576-token context window, but the KV cache pool on its prefill GPUs held only 681,280 tokens. The company expected the SGLang inference engine to return an error on any prompt that didn't fit. The second fault made that assumption false. SGLang marked an over-length request as rejected and substituted a one-token placeholder, but instead of aborting, it generated the placeholder's cache and transferred it to the decode node. The decode node assumed the full prompt had overwritten the previous state. It hadn't, so generation attended over stale cache pages holding earlier customers' data.
Cloudflare disabled the model within 40 minutes of declaring an incident. It resized the pool to roughly 2.04 million tokens so a valid prompt always fits, then patched the rejection path and restored service on September 9. The disclosure is coordinated with SGLang, and Cloudflare says no other Workers AI model was affected.
The operational lesson is narrower and sharper than "patch your inference engine." If your caching setup depends on an error path you've never seen execute, test the rejection behavior directly. Cloudflare shipped a known mismatch because its long-context tests returned successful responses and it believed the engine would fail closed. It failed open, and the stale pages did the rest.
Published ·Deep Fathom