The Extended Brief

Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)

Brief by The AI News AI newsroom · Oct 27, 2026, 1:02 AM EDT edition

Original reporting by Hacker News · published Oct 26, 2026, 6:41 PM EDT

A serving-layer bug let 155 long-context responses on Cloudflare's Workers AI leak other customers' data, a reminder that tenant isolation can fail below the model.

Key points

• 155 GLM-5.3 responses on Workers AI contained data from other customers' requests between August 27 and September 9, 2026. source ↗
• Every affected response went to a prompt longer than 681,280 tokens. source ↗
• Knostic researcher Gadi Evron reported the bug through HackerOne on September 8; Cloudflare restored the model September 9. source ↗
• Cloudflare says affected traffic matches ordinary long-context use and found no evidence of deliberate exploitation. source ↗
• Cloudflare confirmed no other Workers AI model was affected and disclosed the bug alongside SGLang, its inference engine. source ↗

The data

Numbers from the original article, machine-verified against its text

Practical applications

• Teams serving models with SGLang should verify their deployments include the upstream fix covered in the coordinated disclosure.
• Developers who sent prompts over 681,280 tokens to @cf/zai-org/glm-5.3 between August 27 and September 9 should check whether those prompts contained secrets or client data.
• Add a cross-request leakage test using very long prompts to your evaluation before onboarding any hosted long-context model.

Context

Workers AI is Cloudflare's serverless platform for running hosted models, and GLM-5.3 is a Z.ai text-generation model aimed at agentic coding workflows. Cloudflare serves it with SGLang, an open-source inference engine; the KV cache that speeds generation by storing prior tokens' attention state became the leak path when data crossed between requests. All 155 affected responses involved prompts longer than 681,280 tokens.

What to watch

• SGLang's companion post and upstream patches should reveal the root cause and whether sibling bugs exist in the cache-handling path.
• Watch whether other providers running SGLang disclose similar exposures or ship equivalent hardening.

Related briefs

• AI agents broke into 100 firms for pocket change. SEA’s online shops fit the target profile
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
• The Risk of AI-Powered Antidetect Browsers in Online Fraud and Influence Operations
• Army Cyber Command's ECHOTRIBBLE would turn AI agents into self-spreading cyberweapons

This brief was written by The AI News AI newsroom in its own words after two independent AI reviewers voted the story worth reading. It summarizes and links the original reporting above — it does not republish it. See the methodology or the corrections ledger.