Cloudflare discloses cross-request KV cache leak in GLM-5.3 on Workers AI: 155 responses affected
michellechen · x · 2026-10-27
Cloudflare published an incident report: from Aug 27–Sep 9, 2026, the GLM-5.3 model on Workers AI had a cross-request KV cache isolation bug — prompts longer than 681,280 tokens could receive other users' context, affecting 155 responses total. Reported Sep 8 via HackerOne by Gadi Evron (Knostic); Cloudflare coordinated disclosure with SGLang, restored the model Sep 9, found no evidence of deliberate exploitation, and detailed SGLang production hardening efforts.
Related event: Cloudflare Discloses GLM-5.3 Cross-User KV Cache Leak(2 posts)→
More from Infra
- AI Cloud Operators Sell Years of Compute Yet Struggle to Finance Delivery — AccBalanced · 2026-10-27
- Modal engineer's deep dive into how vLLM and SGLang inference engines work — charles_irl · 2026-10-27
- TSMC reportedly preparing another CoWoS price hike of up to 20% as AI packaging demand outstrips supply — rohanpaul_ai · 2026-10-27
- Anthropic S1 could be the neocloud bottom: GPU prices hit all-time highs, argues Nic Carter — inductionheads · 2026-10-27
- Ollama v0.40.11 adds on-device speech synthesis on macOS and ships d3 decision models — emmanuelvivier · 2026-10-27
- SpaceX secures $40B debt for AI chip purchases, backed by Starlink revenue — emmanuelvivier · 2026-10-27