Cloudflare confirmed on October 26, 2026, that 155 responses from its GLM-5.3 model on Workers AI contained data from other customers' sessions, because the model's advertised 1,048,576-token context window sat on a prefill KV pool that held only 681,280 tokens. The gap was 367,296 tokens, about 35 percent of the promised context, and every affected response went to a prompt longer than the pool could hold. Cloudflare says it found no evidence of deliberate exploitation, and that no other Workers AI model was affected.
The two faults that had to overlap
Neither fault alone would have leaked anything. The misconfiguration alone would have produced errors, if the engine had errored. The engine bug alone would never have been reached, if no prompt had overflowed the pool. Together, they turned an oversized prompt into a window into another customer's session, and returned it with a normal success code.
| Fault | What happened | Why it mattered |
|---|---|---|
| Pool smaller than context | GLM-5.3 launched August 27, 2026, with a 1,048,576-token context window and a prefill KV pool of 681,280 tokens | Any prompt over 681,280 tokens overflowed the pool, even though it fit the advertised window |
| SGLang rejection bug | An over-length prompt was marked rejected and swapped for a one-token placeholder, but the disaggregated handoff treated it as live | Decode reserved pages for the full prompt, received one page of real data, and read the rest from pages earlier requests had left behind |
| Pages are not zeroed | KV cache pages are reused without clearing, for performance, and ownership tracking is the engine's job | Stale pages still held earlier users' prompts and partial generations when decode read them |
The thirteen days, hour by hour
Cloudflare's own timeline is unusually precise, and it cuts both ways. The response, once a researcher reported the leak, was fast: reproduced within a day, contained within hours, fixed the same day. The exposure before that report lasted from launch to restoration, thirteen days in which the flaw was live and nobody inside the company had caught it.
| When (UTC) | What happened |
|---|---|
| August 27, 2026 | GLM-5.3 launches on Workers AI with the pool smaller than the context window; the exposure is present from launch |
| September 8, 23:11 | Security researcher Gadi Evron of Knostic files a report through Cloudflare's HackerOne program |
| September 9, 08:00 | Cloudflare begins verifying the report |
| September 9, 13:22 | Incident declared after the leak is reproduced with two independent accounts within 25 minutes |
| September 9, 14:00 | GLM-5.3 set to private; requests return an error |
| September 9, 14:35 | Root cause identified: the prefill pool is smaller than the context length |
| September 9, 19:04 | Full deployment rebuilt with the corrected configuration plus a Cloudflare-authored engine patch |
| September 9, 19:40 | Model restored to public |
| October 19, 2026 | SGLang v0.5.22 released, bundling the admission fix and related hardening |
| October 26, 2026 | Coordinated public disclosure with the researcher and the SGLang maintainers |
Why the tests missed it
Cloudflare admits the most instructive part of the story itself: the team knew about the size mismatch before launch. Pre-launch long-context tests returned successful HTTP status codes and a streaming body with no error frames, so the team assumed the engine handled the gap gracefully, perhaps by streaming or some other mechanism. The gap in testing, in Cloudflare's own words, was that it validated response codes and engine performance at long contexts without validating model output and coherence. A reply that arrived faster than a full prefill should take, and that contained another customer's content, still looked like a success to every check that was running. That is the detail every hosted-inference operator should sit with, because it is not a Cloudflare-only mistake. Any test suite that checks whether a model answered, and never checks whether the answer belongs to the question asked, will pass this bug every time. It is the kind of plumbing failure our 2026 AI security report card tracks across the year, where the leak surface has moved from the model to the infrastructure around it.
What this means for anyone renting inference
The fix has two layers, and both matter. Cloudflare enlarged the prefill pool to about 2.04 million tokens, roughly twice the context length, so a valid prompt always fits and the rejection path is never reached. It also patched the engine so a request carrying a pending rejection is retired at the admission queue with its original error, before any allocation or transfer happens, and it applied that hardening to every model it serves with SGLang. The first layer removes this instance. The second removes the class, because pool sizes change whenever quantization, tensor parallelism, or a model version changes, and a fix that depends on one number staying right will eventually be wrong again. For anyone running SGLang in a split prefill and decode setup, Cloudflare's recommendation is direct: update to v0.5.22 or later. For anyone buying hosted inference rather than running it, the questions to ask a provider now are concrete: does the running engine's pool hold the full advertised context, is that checked on the live deployment rather than inferred from a spec sheet, and are long-context tests checking output coherence rather than status codes alone. The plumbing is where the next exposure will come from, and the next test suite that only checks status codes will miss it the same way.
Three limits on the story
Three limits keep this story honest. First, 155 is the number of affected responses Cloudflare identified, not a count of prompts sent or customers exposed, and the company does not publish either denominator. Second, the "no deliberate exploitation" finding is a statement about timing and volume: after excluding its own testing and the researcher's requests, the affected requests looked like ordinary long-context use rather than repeated probing of the bug. That is evidence about pattern, not proof about intent, and it should be read that way. Third, the six-week gap between the September 9 fix and the October 26 disclosure was a coordinated wait for upstream fixes to land in SGLang releases, not a period in which the flaw stayed live: the model was restored the same evening it was taken down, with both the configuration fix and the engine patch in place. The disclosure delay is defensible. The pre-launch decision to ship a known mismatch on the strength of green status codes is the part that is not.
By ByteHerald Staff. Cloudflare, October 26, 2026, reported that 155 GLM-5.3 responses on Workers AI contained data from other customers' sessions, that all affected prompts exceeded 681,280 tokens, and that researcher Gadi Evron of Knostic reported the issue through HackerOne on September 8, 2026. SGLang, October 19, 2026, released version 0.5.22 bundling the admission fix and related hardening, as cited in Cloudflare's coordinated disclosure.
Comments
Post a Comment