Cloudflare said on 26 October 2026 that between 27 August and 9 September a small number of customers using the GLM-5.3 model on Workers AI (@cf/zai-org/glm-5.3) received responses containing data from other customers' requests made to the same model shortly before theirs. Cloudflare counts 155 affected responses, all to prompts longer than 681,280 tokens, and says it found no evidence of deliberate exploitation and that no other Workers AI model was affected.

Cloudflare says security researcher Gadi Evron of Knostic reported the issue through its HackerOne program on 8 September; Cloudflare reproduced it the next morning, took the model offline within 40 minutes of declaring an incident, and restored it on 9 September with a corrected configuration and a patched inference engine. Cloudflare gives two causes. First, it deployed GLM-5.3 with a 1,048,576-token context window while the KV cache pool on its prefill GPUs held only 681,280 tokens, a mismatch it says it knew about before launch but expected the engine to handle with an error.

Second, in disaggregated prefill/decode mode the open-source SGLang inference engine marked such over-length prompts as rejected and swapped them for a one-token placeholder instead of aborting them with a client error, so the decode node generated a reply while reading cache pages that still held data from earlier requests.

In its own post the same day, the SGLang project (LMSYS) says a separate, related race in disaggregated serving could let RDMA writes still in flight from an aborted request land in another request's KV cache, causing one-way cross-request leakage that leaves no error or log line; it says default configurations of disaggregated deployments were affected from the v0.4.x line until v0.5.21 (v0.5.22 for the MORI backend), and that single-instance deployments without this cross-engine transfer path are not affected by that race.

No CVE is listed in either post. Primary: Cloudflare; SGLang (LMSYS).