Cloudflare disclosed that its GLM-5.3 model on Workers AI returned fragments of other customers' requests in 155 responses between August 27 and September 9, caused by a cache-size mismatch and an inference-engine bug.
Cloudflare disclosed on October 26 that its GLM-5.3 model on Workers AI returned data from other customers' requests in 155 responses between August 27 and September 9, 2026. The model, from Z.ai, is built for agentic coding workflows and is one of many models available through Workers AI.
Two overlapping problems caused the exposure. Cloudflare deployed GLM-5.3 with a 1,048,576-token context window, but the key-value cache pool on its prefill graphics processors held only 681,280 tokens. Separately, a bug in the open-source SGLang inference engine marked over-length prompts as rejected and replaced them with a one-token placeholder, yet instead of aborting the request it let the decode stage generate a response while reading stale cache pages left by earlier requests. Every affected response answered a prompt longer than 681,280 tokens, and each arrived with a normal HTTP 200 success code.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare's HackerOne program on September 8. Cloudflare reproduced it the next morning, took the model offline within 40 minutes of declaring an incident, deployed a corrected configuration and a patched engine, and restored service the same day, at 19:40 UTC on September 9. Further hardening was rolled out to its SGLang deployments between September 11 and 19.
Cloudflare's own blog confirms the scope, the mechanism and the timeline, and it is candid about the testing gap: the company knew about the cache mismatch before launch, expected the engine to return an error for prompts it could not process, and checked HTTP status codes and engine performance at long context lengths rather than the quality of the output. Cloudflare says it found no evidence of deliberate exploitation, that the affected traffic matched ordinary long-context use, and that no other Workers AI model was affected. It gives no exact count of affected customers, describing them only as a small number.
The stakes go beyond one model. In disaggregated inference serving, the cache pool is a tenant-isolation boundary, and a success code proved to be no evidence that an answer belonged to the customer who asked for it. Any organisation sending regulated or confidential data through a hosted model now has a concrete question to ask its provider: how large is the cache pool relative to the advertised context window, and are outputs tested for coherence, not just for a successful status code.
Cloudflare recommends that operators running SGLang upgrade to version 0.5.22 or later and check cache-pool size against context length directly, a check that would have caught the mismatch before GLM-5.3 served its first long prompt.