# Cloudflare discloses GLM-5.3 KV cache leak that exposed other users' data

> Original title: Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)

- Source: Hacker News · AI (150+ points)
- Published: 2026-10-26T22:41:48.000Z
- Bad Influence: https://badinfluence.news/items/d7x9vyg01e53s4mv2mpqvjdd1
- Original: https://blog.cloudflare.com/kv-cache-exposure-remediation/

## Summary

Cloudflare says a security researcher reported that GLM-5.3 on Workers AI returned responses containing data from other customers' requests. It says 155 responses were affected between August 27 and September 9, all to prompts over 681,280 tokens. Cloudflare attributes the bug to a KV pool smaller than the model's context window, combined with an SGLang bug that let rejected requests reach decode with stale cache pages. It says the model was restored after fixes and recommends operators upgrade to SGLang v0.5.22 or later.

## Why it matters

The post shows how a KV cache misconfiguration and an SGLang admission bug let one user's GLM-5.3 responses contain other users' data, and what operators should check.