The GLM-5.3 model on Cloudflare's Workers AI handed some customers text that belonged to other customers' sessions between August 27 and September 9. Cloudflare has since laid out how the leak worked and what it changed.
Cloudflare counted 155 affected responses, each triggered by a very long prompt. After it removed its own testing and the reporting researcher's, the rest matched ordinary long-context use in both timing and volume, and the company says it found no evidence that anyone exploited the flaw on purpose.
The gap opened on launch day. When Cloudflare put GLM-5.3 into service, the model accepted prompts of up to 1,048,576 tokens. The memory pool reserved for cached attention data on the prefill GPUs, though, could store only 681,280 tokens, about 65% of that limit. Engineers knew the numbers differed and expected the SGLang serving software to refuse any prompt that did not fit. Pre-launch long-context tests got normal success codes back, but they measured response codes and speed rather than whether the answers were coherent.
A bug in SGLang turned that mismatch into a leak. In the setup where one group of machines reads the prompt and another writes the reply, an oversized prompt was flagged as rejected and replaced by a single placeholder token. Both queues then checked only whether a request was finished, and a rejected one did not count as finished, so it moved on. The prefill side shipped one page of cache and announced success. The reply machine had reserved eight pages for the real prompt in Cloudflare's worked example, but only one had been written, so it read the other seven as they were: leftovers from earlier customers. The caller saw a normal, fluent answer with no error.
Security researcher Gadi Evron of Knostic filed the report through HackerOne on September 8. Cloudflare reproduced it the next morning, set the model to private about 40 minutes after declaring an incident, and brought it back that evening. The fix has two parts: GLM-5.3 now follows the settings used for GLM-5.2, which leaves enough GPU memory for a prefill pool of about 2.04 million tokens, nearly double the prompt limit, and a Cloudflare-written patch retires a rejected request with its original error before any data moves. Cloudflare says GLM-5.3 was the only model affected, since every other disaggregated model on the platform already had a pool larger than its prompt limit.
Other SGLang users running the split setup need the upstream changes below; Cloudflare advises v0.5.22 or newer, or backporting the patches.
| SGLang release | What it changes |
|---|---|
| v0.5.20 | Pull request 36988 stops aborted prefill work from reaching the reply machines, which closes this leak |
| v0.5.21 | Pull request 38935 turns oversized prompts away at the door, before any allocation or cache transfer |
| v0.5.22 | Suggested minimum; adds router and abort-handling follow-ups |
Cloudflare now compares pool size with the prompt limit on the live engine before shipping any change to a split deployment. It is also working with SGLang's maintainers on ownership tags for each cache page, a prototype that cost under 1% in throughput and tail latency but was shelved over reliability problems. Separately, Cloudflare is applying formal methods to the RDMA transfer protocol to rule out this class of bug as far as its provers can.
