Cloudflare's GLM-5.3 model leaked other customers' prompts

Cloudflare has disclosed that its GLM-5.3 model on Workers AI leaked fragments of other customers’ prompts into live responses for two weeks in late summer. Between 27 August and 9 September, 155 responses to prompts longer than 681,280 tokens contained data from unrelated users’ requests, returned as an ordinary HTTP 200 instead of an error.

The cause was a mismatch: GLM-5.3 shipped with a 1,048,576-token context window, but its prefill GPUs only had KV cache room for 681,280 tokens. A bug in SGLang, the inference engine, meant over-length requests that should have been rejected were admitted anyway, and decode read KV cache pages still holding other users’ prompts and partial generations, returning them as a coherent reply. Security researcher Gadi Evron of Knostic reported it through HackerOne on 8 September. Cloudflare reproduced the leak the next morning, took the model offline within 40 minutes of declaring an incident, and restored it the same day with the KV pool enlarged to roughly 2.04 million tokens and a patched SGLang.

Why it matters: this is a concrete, numbers-backed cross-tenant data leak on a major multi-tenant inference platform, not a theoretical risk. If you run SGLang with disaggregated prefill and decode for your own multi-tenant inference, Cloudflare’s advice is to update to SGLang v0.5.22 or later and to check that your KV cache pool can always hold your advertised context window.

The caveat: Cloudflare says it found no evidence of deliberate exploitation, and has not disclosed how many distinct customers were affected beyond “a small number.”