Cloudflare discloses a GLM-5.3 leak
On 26 October 2026 Cloudflare published a report on a tenant-isolation failure in its Workers AI deployment of the GLM-5.3 model: between 27 August and 9 September, 155 responses to prompts longer than 681,280 tokens contained data from other customers' requests. A security researcher reported it on 8 September; Cloudflare took the model offline within 40 minutes of declaring an incident on 9 September and found no evidence of deliberate exploitation. The causes were a GPU cache pool smaller than the context window and a bug in the SGLang engine; the report came out as a coordinated disclosure.
Why it matters
Prompts crossing between users of a hosted model is the failure that hosted inference promises not to have. Here it had two ordinary causes: a deployment whose cache pool was smaller than its advertised context window (Cloudflare says it knew of the mismatch before launch and tested only response codes, not the output) and an engine path that treated a rejected request as live. The report is Cloudflare's own and puts its own fault first; the engine side is corroborated by SGLang's public issue of 6 July and by release dates. "A small number of customers" and the 155 responses are Cloudflare's count.
Timeline (UTC, per Cloudflare): 27 August GLM-5.3 launched; 8 September, 23:11, report via HackerOne from Gadi Evron (Knostic); 9 September at 13:22 an incident was declared (reproduced within 25 minutes), at 14:00 the model was made private (requests return HTTP 400), at 19:40 it was restored after a configuration fix and an engine patch; SGLang v0.5.20 on 18 September, v0.5.21 on 2 October, v0.5.22 on 19 October; 26 October coordinated publication with the researcher and RadixArk. Mechanism: the KV cache pool on the prefill nodes held 681,280 tokens against a context window of 1,048,576; a prompt that did not fit was replaced by the engine with a one-token placeholder in disaggregated mode (prefill and decode on different nodes) but not aborted, so the decode node received "transfer complete" and read cache pages that still held data from earlier requests. Only GLM-5.3 had such a pool; every other Workers AI model has a pool larger than its context. Cloudflare reconfigured the pool to about 2.04 million tokens, proposed an upstream fix (#38704, whose approach was merged as #38935) and applied hardening to all its SGLang deployments. Third party. SGLang's public issue #30233, opened by another user on 6 July 2026, describes aborted over-length requests making decode generate garbage from an incomplete cache; the GitHub release dates of v0.5.20 to v0.5.22 are 18 September, 2 and 19 October. What the record does not claim. The count of 155 responses excludes Cloudflare's own tests and the researcher's. SGLang's own post of 26 October agrees with Cloudflare on the dates, the context length and the cache pool size and names the fixes; it takes the scope and customer impact from Cloudflare's report and gives no count of its own. The fault is not in the GLM model from Z.ai itself.