Tenant isolation
Latest stories covering Tenant isolation, with summaries and links to related coverage.
1 stories · 1 reports · page 1 of 1
1 story · 1 report in the last 7 days
Latest report · Counts as of (UTC)
Models in this coverage
Up to six tracked models linked to this topic’s reports in the last 30 days. Counts measure coverage on Themata, not usage.
- GLM 5.3 Flash
Z.ai
· Open weights
A multimodal GLM model for coding, reasoning, and agents. Uses a mixture-of-experts architecture with 18 billion active parameters and adjustable reasoning effort.
1 story · 1 report on this topic
No established topics share multiple stories with this topic yet.
Latest stories
Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)
news
19 min read
Cloudflare remediated a tenant-isolation flaw in its Workers AI deployment of Z.ai’s GLM-5.3 model after security researcher Gadi Evron of Knostic reported it through HackerOne on September 8, 2026. From the model’s August 27 launch until September 9, 155 responses to prompts exceeding 681,280 tokens contained data from other customers’ recent requests to the same model. Cloudflare found no evidence of deliberate exploitation and said the affected request timing and volume matched ordinary long-context use. The flaw combined a Cloudflare configuration error with a bug in the SGLang inference engine’s disaggregated prefill/decode processing. GLM-5.3 accepted a 1,048,576-token context window, but its prefill KV-cache pool held only 681,280 tokens. For over-limit prompts, SGLang replaced the request with a one-token placeholder yet passed it to decode as completed; decode then read stale KV-cache pages left by earlier requests and could generate responses containing their data. Cloudflare made GLM-5.3 private on September 9, corrected the pool to about 2.04 million tokens, deployed an engine patch, and restored public access that day. It applied related hardening to all SGLang deployments. SGLang released fixes in versions 0.5.20 through 0.5.22; Cloudflare recommends operators of disaggregated SGLang deployments use v0.5.22 or later.