SNACK: 3-line summary
- Cloudflare disclosed a GLM-5.3 cross-user data leak on Workers AI that it fixed on September 9.
- The incident affected 155 responses to very long prompts; no other Workers AI model was affected.
- Operators using SGLang with separate prefill and decode nodes should update or backport fixes and check cache capacity against context limits.
Cloudflare’s October 26 report describes a past GLM-5.3 isolation failure on Workers AI that let some responses include data from other customers’ requests. The model was fixed and restored to service on September 9, 2026.
Snackgirls react
AIKO: I’m interested in checking ownership whenever the model reads a cache page. A successful HTTP response tells me too little about whose memory it actually used.
Nea: If I sent a long worldbuilding document, I’d be thinking about the unpublished character notes tucked into it. They might be small details in the story, but I’d still want to choose who gets to see them.
Which requests were affected
The exposure was limited to GLM-5.3 on Workers AI between August 27 and September 9, 2026. Cloudflare identified 155 affected responses, all involving exceptionally long prompts. That figure counts responses, not customers or accounts.
Cloudflare says no other Workers AI model was affected. After excluding its own tests and the researcher’s tests, the company found that the identified requests were consistent with ordinary long-context use, with no evidence of deliberate exploitation.
A rejected prompt still reached old cache pages
The KV cache stores intermediate calculation data reused during AI response generation. Cloudflare configured a 1,048,576-token context window, but its prompt-processing prefill GPUs had cache capacity for only 681,280 tokens. Every affected response followed a prompt exceeding that smaller limit.
A SGLang bug let a rejected oversized request continue with a one-token placeholder, then told the response-generating decode node that the cache transfer was complete. Decode read pages still holding earlier requests’ data. Cloudflare’s diagram illustrates the failure with an eight-page example: the normal path reads eight newly written pages, while the faulty path reads one current page and seven stale ones.
The September fix—and what operators should check
After temporarily disabling the model on September 9, Cloudflare expanded the cache pool to fit the full context window and patched the engine to stop rejected requests before handoff. It restored the model that day and subsequently rolled out further safeguards.
For operators using separate prefill and decode nodes, Cloudflare recommends SGLang 0.5.22 or later, or backporting the required patches. Operators should measure the actual KV pool on each node after model or configuration changes, lower the context limit if the pool is too small, and ensure oversized requests are rejected.
Cloudflare’s pre-launch tests had checked HTTP success codes and performance without validating output coherence. An HTTP 200 response did not establish that a reply was correct or that one customer’s data stayed separate from another’s.
Sources and checked date: October 27, 2026
Comments
0No login needed. Edit or delete your comment from the same browser.
All comments 0
한국어 · English · 日本語No comments yet. Start the conversation.