Cross-KV-cache exposure bug found in GLM-5.3 on Workers AI, disclosed jointly
michellechen · x · 2026-10-27
michellechen published an incident report for a cross-KV-cache exposure bug affecting GLM-5.3 on Workers AI, which could let GPU memory data leak across users. No exploitative behavior was detected, and disclosure was coordinated jointly with the researcher and the SGL project.
Key points:
- The author notes this is not the first such exposure nor the last — GPU memory safety remains largely unsolved industry-wide;
- In such a nascent space there is no silver bullet against GPU memory-safety bugs, and the team is fixing it proactively for everyone rather than keeping security fixes as proprietary IP;
- Full technical analysis and mitigations are in the accompanying blog post.
Related event: Cloudflare Discloses GLM-5.3 Cross-User KV Cache Leak(2 posts)→
More from Safety
- One prompt turns Claude into a hotel hidden-camera detector that scans the WiFi in two minutes — alex_verem · 2026-10-27
- Screenshot: DeepSeek V4.1 Flash analysis shows bug hunting gets costlier as easy vulns dry up — jd_pressman · 2026-10-27
- Apple open-sources Private Cloud Compute components, giving researchers a real attack surface — jedisct1 · 2026-10-27
- REA-Prompts: 2.8k-star prompt library turns coding agents into reverse engineers — Promptmethus · 2026-10-27
- AI Evaluator Forum Releases AEF-1: Minimum Operating Conditions for Independent AI Evaluations — RishiBommasani · 2026-10-27
- Robert Wiblin's blunt plea to AI devs: don't hide behind the race — KatjaGrace · 2026-10-27