Cloudflare: 155 GLM-5.3 responses leaked other users' prompt data
Victoria Shinder2 min readCloudflare has published a coordinated disclosure of a tenant-isolation failure in the GLM-5.3 model on Workers AI. Between 27 August and 9 September, 155 responses contained data from other customers' requests made to the same model shortly before. All were answers to prompts longer than 681,280 tokens. The issue was reported on 8 September by researcher Gadi Evron of Knostic through HackerOne; Cloudflare reproduced it the next morning, took the model offline within 40 minutes of declaring an incident and restored it the same day. It says no other Workers AI model was affected and it found no evidence of deliberate exploitation.
Two problems overlapped. The model was deployed with a 1,048,576-token context window, but the KV cache pool on the prefill GPUs held only 681,280 tokens — a mismatch Cloudflare knew about and expected the engine to reject cleanly. Instead, in SGLang's disaggregated prefill/decode mode, an over-length prompt was marked as rejected and replaced with a one-token placeholder, yet the request was not aborted. Prefill computed the cache for the placeholder and told the decode node the transfer was complete, so decode generated a response over cache pages still holding earlier requests' data. KV pages are not zeroed between requests.
The fixes: the pool was resized to about 2.04 million tokens, roughly twice the context length, and the engine was patched so a request with a pending rejection is retired with its error before any allocation or transfer. Cloudflare proposed this upstream as SGLang #38704; maintainers also merged #38935.
What it means
The root cause is two numbers that nothing forced to agree: the advertised context length is configuration, the pool size is whatever GPU memory is left after loading weights. Anyone running a disaggregated inference stack should check both, and should not read a 200 status with a streaming body as proof that a long prompt was actually processed.