Cloudflare has disclosed and remediated a tenant isolation issue in the GLM-5.3 Workers AI model (@cf/zai-org/glm-5.3). On September 8, 2026, security researcher Gadi Evron of Knostic alerted Cloudflare to the problem, which had begun on August 27, 2026. The model was restored on September 9. Cloudflare confirmed that no other model hosted on Workers AI was affected.
Between August 27 and September 9, a small number of customers using GLM-5.3 received responses containing data from other customers' requests made to the same model shortly before theirs. The root cause was cross-request exposure in the KV cache of the open-source inference engine SGLang, which Cloudflare uses in production.
- 155 responses were affected in total, all to prompts longer than 681,280 tokens.
- After excluding Cloudflare's own testing and the researcher's, the identified requests match ordinary long-context usage in timing and volume, not repeated exploitation.
- Cloudflare found no evidence of deliberate exploitation.
- The model was taken down and restored on September 9, 2026.
- Cloudflare hardened its production SGLang deployments following the incident.
The disclosure is coordinated with a companion post from the SGLang project, the open-source inference engine Cloudflare relies on. The Cloudflare report covers the bug itself, the response timeline, and the subsequent hardening work on production SGLang deployments.
For developers, the incident is a reminder that tenant isolation in shared inference infrastructure depends on cache handling as much as on request routing. Applications that send long-context prompts—precisely the workloads where the affected responses occurred—are the most exposed to this class of bug. Anyone building on Workers AI should review their use of @cf/zai-org/glm-5.3, confirm they were not among the affected requests, and treat cross-tenant data boundaries as a factor when selecting or self-hosting inference engines such as SGLang.
Source: https://blog.cloudflare.com/kv-cache-exposure-remediation/