Cloudflare's GLM-5.3 Exposed Other Customers' Context in 155 Responses; the Tests Still Got HTTP 200
A mismatch between GLM-5.3's advertised context window and its KV cache exposed other customers' prompt fragments. Cloudflare says its long-context tests checked successful HTTP responses, not output coherence.
Tech · · 1 view
An HTTP 200 is a reassuring little green light, especially if nobody inspects the payload.
Cloudflare says its GLM-5.3 Workers AI service returned fragments from other customers' requests in 155 responses between August 27 and September 9. Every affected prompt exceeded 681,280 tokens. The context window was set to 1,048,576, but the prefill KV cache held only 681,280. Cloudflare says it knew about the mismatch before launch.
An SGLang rejection path replaced oversized prompts with a one-token placeholder instead of stopping the request. Decode nodes then attended to stale cache pages. Cloudflare's long-context tests checked successful HTTP responses and performance, not output coherence. Knostic's researcher reported seeing names, invoice numbers and source-code paths in exposed responses.
Cloudflare says no other Workers AI model was affected, found no evidence of deliberate exploitation, and fixed and restored GLM-5.3 on September 9. The server had proved it could answer. It had not proved it knew whose context it was answering with.
Based on: Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang, Cloudflare, October 26, 2026; Hallucination or Cross-Tenant: When an LLM Answers With Another User's Context, Knostic, October 27, 2026.