Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)

A security vulnerability in Cloudflare's GLM-5.3 Workers AI model exposed 155 customer responses containing data from other users' requests between August 27 and September 9, 2026. The issue was caused by a misconfiguration and bug in the SGLang inference engine that failed to properly isolate KV cache between requests for prompts exceeding 681,280 tokens. Cloudflare remediated the issue within 40 minutes of identifying it, and no evidence of deliberate exploitation was found.