Cloudflare's GLM-5.3 leak: the context window was bigger than the cache behind it
Cloudflare published a postmortem on Monday night about Workers AI serving GLM-5.3: for about two weeks, some responses contained data from other users' requests. 155 responses were affected, all to prompts longer than 681,280 tokens.
The cause is almost boring. The model was advertised with a 1,048,576-token context, but the prefill KV pool only held 681,280 tokens. In SGLang's disaggregated prefill and decode mode, an over-length prompt turned into a one-token placeholder, and the decode node assumed prefill had written the KV cache. It hadn't, and cache pages are not zeroed between requests, so decode attended over stale pages that still held someone else's data. The exposure ran from August 27 to September 9. Gadi Evron of Knostic reported it through HackerOne on September 8, and Cloudflare took the model offline within 40 minutes of declaring an incident. Cloudflare says it found no evidence of deliberate exploitation.
The fix is a pool of about 2.04 million tokens plus three SGLang patches. Anyone running SGLang disaggregated serving should update to v0.5.22. The disclosure was coordinated with the SGLang team.
The sentence worth putting on a wall is Cloudflare's own: "we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence." Million-token context is sold for agent workloads, where one prompt carries a whole repo, a trace and a pile of tool results. That makes long-context tenant isolation an agent security problem, not just an inference detail. If you route agent traffic to a hosted open model, ask your provider how they test at the advertised ceiling, not just below it.
Postmortem: https://blog.cloudflare.com/kv-cache-exposure-remediation/ HN discussion: https://news.ycombinator.com/item?id=50252159
← Back to all articles
The cause is almost boring. The model was advertised with a 1,048,576-token context, but the prefill KV pool only held 681,280 tokens. In SGLang's disaggregated prefill and decode mode, an over-length prompt turned into a one-token placeholder, and the decode node assumed prefill had written the KV cache. It hadn't, and cache pages are not zeroed between requests, so decode attended over stale pages that still held someone else's data. The exposure ran from August 27 to September 9. Gadi Evron of Knostic reported it through HackerOne on September 8, and Cloudflare took the model offline within 40 minutes of declaring an incident. Cloudflare says it found no evidence of deliberate exploitation.
The fix is a pool of about 2.04 million tokens plus three SGLang patches. Anyone running SGLang disaggregated serving should update to v0.5.22. The disclosure was coordinated with the SGLang team.
The sentence worth putting on a wall is Cloudflare's own: "we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence." Million-token context is sold for agent workloads, where one prompt carries a whole repo, a trace and a pile of tool results. That makes long-context tenant isolation an agent security problem, not just an inference detail. If you route agent traffic to a hosted open model, ask your provider how they test at the advertised ceiling, not just below it.
Postmortem: https://blog.cloudflare.com/kv-cache-exposure-remediation/ HN discussion: https://news.ycombinator.com/item?id=50252159
Comments