Top stories

Cloudflare remediated a tenant-isolation flaw in its Workers AI deployment of Z.ai’s GLM-5.3 model after security researcher Gadi Evron of Knostic reported it through HackerOne on September 8, 2026. From the model’s August 27 launch until September 9, 155 responses to prompts exceeding 681,280 tokens contained data from other customers’ recent requests to the same model. Cloudflare found no evidence of deliberate exploitation and said the affected request timing and volume matched ordinary long-context use. The flaw combined a Cloudflare configuration error with a bug in the SGLang inference engine’s disaggregated prefill/decode processing. GLM-5.3 accepted a 1,048,576-token context window, but its prefill KV-cache pool held only 681,280 tokens. For over-limit prompts, SGLang replaced the request with a one-token placeholder yet passed it to decode as completed; decode then read stale KV-cache pages left by earlier requests and could generate responses containing their data. Cloudflare made GLM-5.3 private on September 9, corrected the pool to about 2.04 million tokens, deployed an engine patch, and restored public access that day. It applied related hardening to all SGLang deployments. SGLang released fixes in versions 0.5.20 through 0.5.22; Cloudflare recommends operators of disaggregated SGLang deployments use v0.5.22 or later.