You send a long prompt to GLM-5.3 on Workers AI, and the response contains data from someone else's request. Between 27 August and 9 September that happened 155 times, according to Cloudflare, and always with prompts over 681,280 tokens. The KV cache, the memory of text already processed, was smaller than the model's context. An over-length prompt had nowhere to sit, and instead of rejecting it, the engine carried on.
Fact
The facts: on 26 October 2026 Cloudflare published a write-up of a bug in GLM-5.3 on Workers AI. In its words, between 27 August and 9 September a small number of customers received responses containing data from other customers' requests. In total 155 responses were affected, all to prompts longer than 681,280 tokens. That is the size of the prefill KV pool, which was smaller than the model's context window. Cloudflare was alerted by researcher Gadi Evron of Knostic through its HackerOne program, and on 9 September it restored the model. The fix is twofold: the configuration (the pool now holds about 2.04 million tokens) and the engine (an over-length request is rejected with an error). Cloudflare says it has no evidence of deliberate exploitation and recommends that all operators update their SGLang dependencies to v0.5.22 or later. There is no CVE number: this is a configuration error in Cloudflare's own service, fixed by Cloudflare itself.
The model did not make anything up. The data was real, just someone else's. What exactly and how many customers, Cloudflare does not say: it writes "a small number".
I know how this looks at a door: when the cloakroom is smaller than the queue, the tickets start getting mixed up. Here the cloakroom was the cache.
The longer the context you promise, the bigger the storage you need.
If you use GLM-5.3 through Workers AI, the write-up has no steps for you: the recommendations are for SGLang operators. If you serve a model with SGLang yourself, you update to v0.5.22 or later.
Official primary sources
Cloudflare - write-up of the cross-request KV cache exposure in GLM-5.3 on Workers AI, 26.10.2026The visual is generated code-art, no third-party images.