PulseAugur
EN
LIVE 01:38:24

Cloudflare GLM-5.3 leak exposed user prompts due to KV cache misconfiguration

By PulseAugur Editorial · [1 sources] ·

Cloudflare has disclosed a critical vulnerability in its Workers AI deployment of GLM-5.3 that allowed prompts from one user to be leaked to another. The issue stemmed from a misconfiguration where the model's context window exceeded the capacity of its KV cache, and a bug in SGLang's error handling caused rejected requests to be processed as if they were valid. This resulted in up to 155 affected responses, where a significant portion of the generated text was derived from previous users' data, effectively continuing their sessions. AI

IMPACT Highlights critical infrastructure risks in LLM deployments and the need for rigorous validation of context window and cache management.

RANK_REASON Disclosure of a specific bug and its reproduction in a deployed LLM service.

Read on dev.to — LLM tag →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

Cloudflare GLM-5.3 leak exposed user prompts due to KV cache misconfiguration

How we ranked this

Signal score
31 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
Disclosure of a specific bug and its reproduction in a deployed LLM service.
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
Breaking (< 6h)
Fresh story with cross-source coverage still developing. Ranking may shift as more sources report.

Full methodology in our editorial standards.

COVERAGE [1]

  1. dev.to — LLM tag TIER_1 English(EN) · frank chu ·

    Cloudflare's GLM-5.3 leaked other users' prompts through its KV cache. I rebuilt the bug in 30 lines.

    <p>Cloudflare published a coordinated disclosure today (October 26) that should be required reading for anyone serving LLMs: for 13 days, its Workers AI deployment of GLM-5.3 (<code>@cf/zai-org/glm-5.3</code>) could return one customer's data inside another customer's response. 1…

RELATED ENTITIES

RELATED TOPICS