On September 8, 2026, Cloudflare was alerted to a tenant isolation issue in the GLM-5.3 Workers AI model starting August 27. The bug exposed 155 responses containing data from other customers' requests, all to prompts exceeding 681,280 tokens. Cloudflare reproduced the issue the next morning and took the model offline within 40 minutes.
The root cause was twofold: a misconfiguration where the KV cache pool on prefill GPUs (681,280 tokens) was smaller than the model's 1,048,576-token context window, and a bug in SGLang's handling of over-length requests. In disaggregated prefill/decode mode, a rejected prompt was replaced with a one-token placeholder; prefill generated the KV cache for this placeholder and transferred it to the decode node. The decode node assumed the cache was overwritten, but majority of previous request data remained intact.
Consequently, the decode node generated responses attending to stale cache pages from earlier requests. Remediation involved adjusting the GLM 5.3 configuration to match GLM 5.2, increasing the KV cache pool to approximately 2.04 million tokens, and hardening the rejection path in the inference engine to prevent future exploitation. Cloudflare is publishing this report alongside SGLang's coordinated disclosure detailing the bug and ongoing upstream efforts to address similar issues.
Source: Hacker News · Summarized by HeadlinesBriefing