Cloudflare Workers AI leaked prompts in 155 GLM-5.3 replies

For two weeks, a hosted model returned other people's data with a clean HTTP 200. Cloudflare says a Workers AI KV cache bug caused 155 GLM-5.3 responses to include fragments of other customers' prompts and partial generations between August 27 and September 9. No error was raised. No monitor fired. An outside researcher found it. If you send customer data to a shared inference API, this is the failure mode to plan for.

What actually happened

Cloudflare published the full post-mortem on October 26. The details:

• The model. @cf/zai-org/glm-5.3, advertised with a 1,048,576-token context window. Cloudflare says no other Workers AI model was affected.
• The trigger. Only prompts longer than 681,280 tokens. That was the size of the prefill KV cache pool. Cloudflare knew about the mismatch before launch but did not check output quality at that length.
• The bug. In the open-source SGLang serving engine, an over-length request was marked rejected but not aborted. The disaggregated queue checked "finished," not "rejected," so the request moved on. The decode node then read stale KV pages from earlier requests and generated from them. The same bug was filed upstream as SGLang issue #30233 on July 6.
• Who found it. Gadi Evron of Knostic reported it through Cloudflare's HackerOne program on September 8. Cloudflare took the model private the next day.
• The fix. A KV pool of about 2.04 million tokens, an SGLang patch that rejects over-length requests before any KV transfer (shipped in v0.5.20 through v0.5.22), and new pre-deployment checks.

Cloudflare's own summary of the gap: it validated response codes and engine speed at long context, but not whether the output made sense. It found no sign of deliberate exploitation. The post says "a small number of customers" got other customers' data, with no exact count.

Why it matters for your business

Status codes tell you the server answered. They do not tell you it answered your question. Most AI integrations we audit log latency, token counts, and HTTP status, and stop there. That stack would have seen nothing here.

Three things to do this week:

1. Keep prompts well below the advertised context window. Edge-of-spec lengths are where vendor testing is thinnest. If you do need huge contexts, chunk them and retrieve.
2. Check output, not just transport. Run a cheap relevance check on replies: does the answer mention entities from the prompt? Does it contain names, emails, or order numbers that were never in the input? Flag those and stop.
3. Minimize what you send. Strip PII before a prompt leaves your system. A leaked prompt with tokenized IDs is an incident report. A leaked prompt with full customer records is a breach notice.

If you self-host SGLang in disaggregated mode, Cloudflare's advice is direct: upgrade to v0.5.22 or later and confirm your KV pool covers your full context length.

Sources: Cloudflare: KV cache exposure remediation, Unite.AI.