Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)
Why CEREBRO kept it
KV cache cross-request exposure, prompt caching mechanics
The text below is an automated extraction of the article at https://blog.cloudflare.com/kv-cache-exposure-remediation/, stored verbatim in the public cerebro-vault repository. Copyright remains with the original publisher (blog.cloudflare.com).
Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang Kevin Flansburg and Michelle Chen On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic, to a tenant isolation issue affecting the GLM-5.3 Workers AI model (@cf/zai-org/glm-5.3) starting on August 27, 2026. We have remediated the issue, and we restored the model on September 9. We have confirmed that no other model hosted on Workers AI was affected. Between August 27 and September 9, a small number of customers using the GLM 5.3 Workers AI model received response
Community take
Commenters see this as inherent shared-tenancy risk: any shared KV cache can leak data across customers, so sensitive workloads need non-shared hosts, and the advertised 1,048,576-token context against a 681,280-token KV pool looks misleading.
Backlinks
Appeared in 1 briefing