Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang

Cloudflare has disclosed that a configuration mismatch in the GLM-5.3 model on Workers AI, combined with a bug in the SGLang inference engine, caused some responses to contain data from other customers' requests between August 27 and September 9, 2026. In total 155 responses were affected, all to prompts longer than 681,280 tokens; Cloudflare says it found no evidence of deliberate exploitation, took the model offline within a day of the report, and has patched the engine and its configuration as part of a coordinated disclosure.