For two weeks, very long prompts sent to the GLM-5.3 model on Workers AI were able to receive fragments of sessions from other users. Cloudflare publishes its incident report.
Cloudflare published on October 26 the report of a security incident that occurred on Workers AI: between August 27, the day GLM-5.3 (the code model of Z.ai), went live and September 9, 155 responses to the model contained pieces of data from other customers' requests. Only prompts exceeding 681,280 tokens were affected. The flaw was reported on September 8 by Gadi Evron, a researcher at Knostic, via the company's HackerOne program.
Two mistakes combined
The model was announced with a context window of 1,048,576 tokens, while the KV cache pool of the prefill GPUs contained only 681,280; Cloudflare acknowledges that it experienced this discrepancy before the launch without having checked the quality of the outputs. A bug in the SGLang inference engine, in disaggregated mode, did the rest: the request that was too long was replaced by a dummy token, but the decoding GPUs read stale cache pages, still filled by previous requests, and returned an HTTP 200 code instead of an error.
On the day of the report, the incident was replicated in 25 minutes, the model made private, and then back up and running the same evening with a cache pool increased to about 2.04 million tokens and a fix rejecting malformed requests. The fixes were integrated into SGLang. Cloudflare says it found no evidence of deliberate exploitation: the affected traffic was consistent with normal long-context usage.
Read the full article on the original source
Go to the source →