# Cloudflare fixes GLM-5.3 bug exposing 155 customer responses

Digest AI · Hardware & Compute · published 2026-10-26T23:05:13Z

Canonical: https://digestai.news/story/cloudflare-fixes-glm-5-3-bug-exposing-155-customer-responses

## Summary

Cloudflare disclosed a cross-request KV cache exposure in its GLM-5.3 model on Workers AI, affecting 155 responses to prompts over 681,280 tokens. Security researcher Gadi Evron of Knostic reported the tenant-isolation issue on September 8, 2026, after the model launched on August 27. Cloudflare confirmed no other models were affected and found no evidence of deliberate exploitation, though the bug stemmed from a misconfigured context window and an SGLang bug in disaggregated serving.

The company patched the issue within hours on September 9, aligning the KV cache pool size with the model’s 1,048,576-token context window. The report recommends operators validate KV pool sizes and enable additional protections like deferred KV release and checksums. Cloudflare is collaborating with SGLang on further safeguards for RDMA-based cache transfers.

## Key points

- Cloudflare patched GLM-5.3 on Workers AI after 155 responses leaked data from other sessions
- Bug affected prompts over 681,280 tokens due to mismatched KV cache and SGLang flaw

## Why it matters

The incident highlights risks in disaggregated AI serving and underscores the need for strict KV cache validation and cross-team coordination between cloud providers and inference engines.

## Sources

1. [Cloudflare Says GLM-5.3 Bug Leaked 155 Responses Across Tenant Sessions](https://unite.ai/cloudflare-says-glm-5-3-bug-leaked-155-responses-across-tenant-sessions) (Unite.AI, 2026-10-26)
2. [Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)](https://blog.cloudflare.com/kv-cache-exposure-remediation) (blog.cloudflare.com, 2026-10-26)

Part of the developing story: [Cloudflare AI Launch And Security Glitch](https://digestai.news/thread/cloudflare-launches-clairic-extraction-model-on-workers-ai-preview) (2 stories)

## Cite

Digest AI, "Cloudflare fixes GLM-5.3 bug exposing 155 customer responses", 26 October 2026, https://digestai.news/story/cloudflare-fixes-glm-5-3-bug-exposing-155-customer-responses

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/cloudflare-fixes-glm-5-3-bug-exposing-155-customer-responses.json